Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1602201
MD5:	f2432fdb07cac95c4481843ff0e77fd7
SHA1:	edc08e196ee4ca14f9a57baeab6723cb42118ce3
SHA256:	66028849a2e0c56e20bc6c17e7acf127cb7da54b8ca1c0eec303fbae79c72888
Tags:	AutoITexeVidaruser-aachum
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

random.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\random.exe" MD5: F2432FDB07CAC95C4481843FF0E77FD7)

cmd.exe (PID: 7028 cmdline: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6512 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3956 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 1456 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1476 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4500 cmdline: cmd /c md 36469 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 3540 cmdline: extrac32 /Y /E Geographic MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6244 cmdline: findstr /V "TEAMS" Mw MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3808 cmdline: cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2020 cmdline: cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Avoiding.com (PID: 2980 cmdline: Avoiding.com L MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 1316 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2300,i,1733554593946630955,15857964922847861043,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2284,i,12414391381378636223,8837719103510671385,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5188 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7012 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

choice.exe (PID: 4472 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 6972 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5104 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6756 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7116 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199820567237", "Botnet": "hac22tl"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Avoiding.com PID: 2980	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Avoiding.com PID: 2980	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Avoiding.com L, ParentImage: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com, ParentProcessId: 2980, ParentProcessName: Avoiding.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 1316, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\random.exe", ParentImage: C:\Users\user\Desktop\random.exe, ParentProcessId: 6880, ParentProcessName: random.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit, CommandLine: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Avoiding.com L, ParentImage: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com, ParentProcessId: 2980, ParentProcessName: Avoiding.com, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit, ProcessId: 5188, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7028, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 1476, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:22:56.090759+0100	2044247	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.7	49921	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:22:57.425475+0100	2051831	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.7	49929	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:22:56.090483+0100	2049087	1	A Network Trojan was detected	192.168.2.7	49921	116.202.5.153	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:22:59.047554+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49939	116.202.5.153	443	TCP
2025-01-29T15:23:00.036943+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49949	116.202.5.153	443	TCP
2025-01-29T15:23:09.298163+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49997	116.202.5.153	443	TCP
2025-01-29T15:23:09.314949+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50000	116.202.5.153	443	TCP
2025-01-29T15:23:10.166637+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50002	116.202.5.153	443	TCP
2025-01-29T15:23:12.661545+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50003	116.202.5.153	443	TCP
2025-01-29T15:23:14.166028+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50004	116.202.5.153	443	TCP
2025-01-29T15:23:21.216798+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50021	116.202.5.153	443	TCP
2025-01-29T15:23:21.237126+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50035	116.202.5.153	443	TCP
2025-01-29T15:23:22.213667+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50042	116.202.5.153	443	TCP
2025-01-29T15:23:24.327138+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50070	116.202.5.153	443	TCP
2025-01-29T15:23:25.516836+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50088	116.202.5.153	443	TCP
2025-01-29T15:23:26.558085+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50099	116.202.5.153	443	TCP
2025-01-29T15:23:28.685611+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50105	116.202.5.153	443	TCP
2025-01-29T15:23:34.001384+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50112	116.202.5.153	443	TCP
2025-01-29T15:23:37.040874+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50116	116.202.5.153	443	TCP
2025-01-29T15:23:47.368388+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50122	116.202.5.153	443	TCP
2025-01-29T15:23:48.119437+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50123	116.202.5.153	443	TCP
2025-01-29T15:23:49.218817+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50124	116.202.5.153	443	TCP
2025-01-29T15:23:50.184623+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50125	116.202.5.153	443	TCP
2025-01-29T15:23:51.293973+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50126	116.202.5.153	443	TCP
2025-01-29T15:23:52.255922+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50127	116.202.5.153	443	TCP
2025-01-29T15:23:53.353999+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50128	116.202.5.153	443	TCP
2025-01-29T15:23:54.406231+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50129	116.202.5.153	443	TCP
2025-01-29T15:23:55.331186+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50130	116.202.5.153	443	TCP
2025-01-29T15:23:56.232903+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50131	116.202.5.153	443	TCP
2025-01-29T15:23:58.474370+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50133	116.202.5.153	443	TCP
2025-01-29T15:23:59.491977+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50134	116.202.5.153	443	TCP
2025-01-29T15:24:00.436955+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50135	116.202.5.153	443	TCP
2025-01-29T15:24:01.477208+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	50136	116.202.5.153	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:23:09.314949+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50000	116.202.5.153	443	TCP
2025-01-29T15:23:10.166637+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50002	116.202.5.153	443	TCP
2025-01-29T15:23:12.661545+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50003	116.202.5.153	443	TCP
2025-01-29T15:23:21.237126+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50035	116.202.5.153	443	TCP
2025-01-29T15:23:22.213667+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50042	116.202.5.153	443	TCP
2025-01-29T15:23:24.327138+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50070	116.202.5.153	443	TCP
2025-01-29T15:23:25.516836+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50088	116.202.5.153	443	TCP
2025-01-29T15:23:26.558085+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50099	116.202.5.153	443	TCP
2025-01-29T15:23:28.685611+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	50105	116.202.5.153	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-29T15:22:53.358163+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.7	49901	116.202.5.153	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000012.00000003.1658489077.000000000456C000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199820567237", "Botnet": "hac22tl"}

Multi AV Scanner detection for submitted file

Source: random.exe	ReversingLabs: Detection: 18%
Source: random.exe	Virustotal: Detection: 18%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.0% probability

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.7:49890 version: TLS 1.2

Source: random.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cryptosetup.pdbGCTL source: Avoiding.com, 00000012.00000002.2445490518.0000000004640000.00000004.00000800.00020000.00000000.sdmp, fctr1d.18.dr
Source:	Binary string: cryptosetup.pdb source: Avoiding.com, 00000012.00000002.2445490518.0000000004640000.00000004.00000800.00020000.00000000.sdmp, fctr1d.18.dr

Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_00406301 FindFirstFileW,FindClose,	5_2_00406301
Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFDC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00CFDC54
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00D0A087
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00D0A1E2
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00CFE472
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_00D0A570
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D066DC FindFirstFileW,FindNextFileW,FindClose,	18_2_00D066DC
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CCC622 FindFirstFileExW,	18_2_00CCC622
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D073D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_00D073D4
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D07333 FindFirstFileW,FindClose,	18_2_00D07333
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00CFD921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\36469\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.7:49921 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49949 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.202.5.153:443 -> 192.168.2.7:49921
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49997 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50003 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50003 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49939 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.7:49901 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.202.5.153:443 -> 192.168.2.7:49929
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50002 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50002 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50021 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50004 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50070 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50070 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50042 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50042 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50000 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50000 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50088 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50088 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50105 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50105 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50099 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50099 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50035 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:50035 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50116 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50112 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50124 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50125 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50131 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50123 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50126 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50136 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50130 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50129 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50122 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50133 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50135 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50128 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50134 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:50127 -> 116.202.5.153:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199820567237

Source: global traffic

HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 2.22.242.105 2.22.242.105
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 20.189.173.10 20.189.173.10

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.35
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 18.173.219.111
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D0D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

18_2_00D0D889

Source: global traffic	HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: gobore.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.d0b81df0decfa0886dfe.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.4sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; MUIDB=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.8ed343c804e9069b52b4.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.4sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; MUIDB=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.a8bc96a9c4710d87d862.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.d9cf730389f6bc5fde4f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.c10f14b49c09af439e5c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1738167617136&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F6FBCECCB8627D1201EE4DCD1063CA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738167617136&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=8ad1eb9ee7d249df80d48e36b45373ca&activityId=8ad1eb9ee7d249df80d48e36b45373ca&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1738167617136&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F6FBCECCB8627D1201EE4DCD1063CA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1AB2e666573eb242ecb50e61738160604; XID=1AB2e666573eb242ecb50e61738160604
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 150sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; MUIDB=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68e3bfab-27a9-4a65-a098-d660a1cb454f; ai_session=Te7V2a8mesHPVVPL9xs64a\|1738167617131\|1738167617131; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":32,"imageId":"BB1msKSh","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z; USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; MUIDB=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=68e3bfab-27a9-4a65-a098-d660a1cb454f; ai_session=Te7V2a8mesHPVVPL9xs64a\|1738167617131\|1738167617131; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=8AD1EB9EE7D249DF80D48E36B45373CA.RefC=2025-01-29T14:23:17Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738167617136&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=8ad1eb9ee7d249df80d48e36b45373ca&activityId=8ad1eb9ee7d249df80d48e36b45373ca&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A2BB88D5DCC4826ABB73EE9CE227FB0&MUID=27F6FBCECCB8627D1201EE4DCD1063CA HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=27F6FBCECCB8627D1201EE4DCD1063CA; _EDGE_S=F=1&SID=0F6E99944F0765EF0C3B8C174E2C649E; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D

Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000017.00000003.1814971311.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814625159.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814895922.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000017.00000003.1814971311.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814625159.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814895922.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000017.00000002.1887440918.0000504C002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: DGGKjBirXBdcY.DGGKjBirXBdcY
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: gobore.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----f3ekn7q1vs0riek6ppppUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: gobore.sbsContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1946224119.0000316C0031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1946224119.0000316C0031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1946224119.0000316C0031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1891973648.0000504C00AFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000017.00000002.1891973648.0000504C00AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036PL
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1946224119.0000316C0031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890368543.0000504C00854000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000017.00000002.1888827118.0000504C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: random.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chrome.exe, 00000017.00000002.1886192918.0000504C00093000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: random.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000017.00000002.1894696381.0000504C00E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000017.00000002.1891155488.0000504C00A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: Avoiding.com, 00000012.00000002.2443368428.0000000000D65000.00000002.00000001.01000000.00000009.sdmp, Avoiding.com.7.dr, Ventures.14.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: random.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000017.00000002.1891392397.0000504C00A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp, l6890z.18.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000017.00000002.1886192918.0000504C00078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000017.00000003.1814971311.0000504C00454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1811779181.0000504C00454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888218674.0000504C004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888088804.0000504C00454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1809997793.0000504C00454000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1886075801.0000504C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892945520.0000504C00CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C00454000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000017.00000002.1886075801.0000504C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892945520.0000504C00CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000017.00000002.1886192918.0000504C00078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000017.00000002.1888218674.0000504C004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comLP
Source: chrome.exe, 00000017.00000002.1886075801.0000504C0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comLPPL
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp, chromecache_469.25.dr, chromecache_465.25.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000017.00000002.1911550528.0000504C01A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes
Source: msedge.exe, 0000001C.00000002.1951110051.000001E81B945000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com-1-0
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, l6890z.18.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000017.00000002.1892517564.0000504C00BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000017.00000002.1892517564.0000504C00BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000017.00000002.1892517564.0000504C00BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888959921.0000504C0068C000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000017.00000002.1888218674.0000504C004EB000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000002.1960411399.0000316C00020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000017.00000002.1898049899.0000504C012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1891392397.0000504C00A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1897750519.0000504C011B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1891155488.0000504C00A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=end
Source: chrome.exe, 00000017.00000003.1812530922.0000504C004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817511822.0000504C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1813599706.0000504C00EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810985233.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816342058.0000504C00D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814361597.0000504C00EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1818933483.0000504C00D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1812503297.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888218674.0000504C004EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreWYQ1qDqU=
Source: chrome.exe, 00000017.00000003.1792295784.00000EFC006C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000017.00000003.1792295784.00000EFC006C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1792195908.00000EFC00694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000017.00000002.1886969010.0000504C0018C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000002.1960411399.0000316C00020000.00000004.00000800.00020000.00000000.sdmp, manifest.json.30.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000017.00000002.1892903175.0000504C00CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/_
Source: chrome.exe, 00000017.00000003.1787723850.00004524002E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1787740372.00004524002EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000017.00000002.1888735521.0000504C0060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1886075801.0000504C0001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889462942.0000504C00740000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000002.1960411399.0000316C00020000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.30.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxPL
Source: chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000017.00000002.1891528779.0000504C00A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000017.00000002.1888827118.0000504C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000017.00000002.1893104398.0000504C00D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000017.00000002.1893104398.0000504C00D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
Source: chrome.exe, 00000017.00000002.1893104398.0000504C00D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000017.00000002.1893104398.0000504C00D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
Source: chrome.exe, 00000017.00000002.1891841831.0000504C00AD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000017.00000002.1888185620.0000504C004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000017.00000002.1888185620.0000504C004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000017.00000002.1887440918.0000504C002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000017.00000002.1887909821.0000504C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab3
Source: chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr, HubApps Icons.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gobore.sbs
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gobore.sbs/
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gobore.sbs/81.0332286-2.6794907
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gobore.sbsb
Source: chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Gq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Jq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Kr
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Qq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Tq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ur
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Xr
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/br
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/eq
Source: chrome.exe, 00000017.00000003.1792195908.00000EFC00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gk
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/ir
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/lr
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/vr
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yq
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1792195908.00000EFC00694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000017.00000003.1792195908.00000EFC00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000017.00000003.1792195908.00000EFC00694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1794492137.00000EFC006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 0000001C.00000002.1966230479.0000316C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000017.00000002.1888876462.0000504C0066C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000017.00000002.1883767157.00000EFC00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000017.00000002.1883767157.00000EFC00238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000017.00000003.1844967372.0000504C019AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardPL
Source: chrome.exe, 00000017.00000003.1791894924.00000EFC003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000017.00000002.1884615775.00000EFC00780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000017.00000002.1888153547.0000504C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840775560.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842841684.0000504C0131C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841346994.0000504C01460000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840976572.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842926086.0000504C01488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000017.00000003.1794601192.00000EFC006FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000017.00000003.1791604099.00000EFC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000017.00000002.1884663462.00000EFC0079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918p
Source: chrome.exe, 00000017.00000002.1884590892.00000EFC00754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000017.00000002.1888153547.0000504C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840775560.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842841684.0000504C0131C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841346994.0000504C01460000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840976572.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842926086.0000504C01488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000017.00000002.1887909821.0000504C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 0000001C.00000002.1966230479.0000316C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000001C.00000002.1966230479.0000316C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000017.00000002.1889992469.0000504C007E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896221019.0000504C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888290996.0000504C004F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000017.00000002.1896221019.0000504C00F78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000017.00000002.1889992469.0000504C007E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888290996.0000504C004F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000017.00000002.1896221019.0000504C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888290996.0000504C004F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000017.00000002.1891111339.0000504C00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887819451.0000504C0038B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890996057.0000504C009F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 0000001C.00000002.1966230479.0000316C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000017.00000002.1889194518.0000504C006F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzenl1
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000017.00000002.1891111339.0000504C00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887819451.0000504C0038B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890996057.0000504C009F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp, chromecache_465.25.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=truePL
Source: chrome.exe, 00000017.00000002.1891111339.0000504C00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887819451.0000504C0038B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890996057.0000504C009F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000017.00000002.1886192918.0000504C00078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000017.00000002.1886417513.0000504C000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000017.00000002.1888153547.0000504C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840775560.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842841684.0000504C0131C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841346994.0000504C01460000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840976572.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842926086.0000504C01488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Avoiding.com, 00000012.00000003.1658489077.000000000456C000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1657810095.0000000004541000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1658554448.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1657478907.000000000456D000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1658114407.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2446829304.0000000004A91000.00000040.00001000.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1657537605.0000000004A9D000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1657650502.0000000004641000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2444410333.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1658114407.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237
Source: Avoiding.com, 00000012.00000003.1658114407.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237hac22tlMozilla/5.0
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Avoiding.com, 00000012.00000002.2444151472.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1657650502.0000000004641000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2444410333.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000012.00000003.1658114407.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbk
Source: Avoiding.com, 00000012.00000003.1658114407.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbkhac22tlMozilla/5.0
Source: chrome.exe, 00000017.00000002.1891392397.0000504C00A4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888218674.0000504C004DC000.00000004.00000800.00020000.00000000.sdmp, l6890z.18.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000017.00000002.1888827118.0000504C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000017.00000002.1893010527.0000504C00CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharP
Source: chrome.exe, 00000017.00000002.1890368543.0000504C00854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Chartk3
Source: chrome.exe, 00000017.00000002.1892903175.0000504C00CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000017.00000002.1894856824.0000504C00E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000017.00000002.1891155488.0000504C00A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890888028.0000504C009A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890888028.0000504C009A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888735521.0000504C0060C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000017.00000002.1888153547.0000504C004B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840775560.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842841684.0000504C0131C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841346994.0000504C01460000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840976572.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842926086.0000504C01488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitPL
Source: chrome.exe, 00000017.00000002.1891528779.0000504C00A80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000017.00000002.1886075801.0000504C0001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000017.00000002.1887195200.0000504C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000017.00000003.1839096905.0000504C00E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000017.00000003.1841939305.0000504C01424000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1898807497.0000504C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840775560.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842841684.0000504C0131C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1840976572.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842926086.0000504C01488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.GeV8o4Zu9xM.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.ibLFXwX0rCY.L.W.O/m=qmd
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Avoiding.com, 00000012.00000002.2449597410.00000000068D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.office.com
Source: 33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000017.00000002.1887440918.0000504C002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.7:49890 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D0F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

18_2_00D0F7C7

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D0F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

18_2_00D0F55C

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

5_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D29FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

18_2_00D29FD2

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D04763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

18_2_00D04763

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CF1B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

18_2_00CF1B4D

Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		5_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFF20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		18_2_00CFF20D

Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\DpInvestigated	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\PromotionalToken	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\PropeciaJoan	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\WestCornell	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_0040737E	5_2_0040737E
Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_00406EFE	5_2_00406EFE
Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_004079A2	5_2_004079A2
Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_004049A8	5_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB8017	18_2_00CB8017
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00C9E1F0	18_2_00C9E1F0
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CAE144	18_2_00CAE144
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00C922AD	18_2_00C922AD
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB22A2	18_2_00CB22A2
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CCA26E	18_2_00CCA26E
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CAC624	18_2_00CAC624
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D1C8A4	18_2_00D1C8A4
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CCE87F	18_2_00CCE87F
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CC6ADE	18_2_00CC6ADE
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D02A05	18_2_00D02A05
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CF8BFF	18_2_00CF8BFF
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CACD7A	18_2_00CACD7A
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CBCE10	18_2_00CBCE10
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CC7159	18_2_00CC7159
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00C99240	18_2_00C99240
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D25311	18_2_00D25311
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00C996E0	18_2_00C996E0
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB1704	18_2_00CB1704
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB1A76	18_2_00CB1A76
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB7B8B	18_2_00CB7B8B
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00C99B60	18_2_00C99B60
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB7DBA	18_2_00CB7DBA
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB1D20	18_2_00CB1D20
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB1FE7	18_2_00CB1FE7

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: String function: 00CAFD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: String function: 00CB0DA0 appears 46 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 004062CF appears 58 times

Source: random.exe

Static PE information: invalid certificate

Source: random.exe

Static PE information: Resource name: RT_VERSION type: 0420 Alliant virtual executable common library not stripped

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: fctr1d.18.dr

Binary string: #WriteOfflineHivesTerminateSetupModuleds\security\cryptoapi\cryptosetup\cryptosetup.cDCryptoSetup module terminatedCryptoSetupNewRegistryCallBackCryptoSetup EntropyWrite given invalid event typeCryptoSetup EntropyWrite given invalid event data sizeWriteEntropyToNewRegistryCryptoSetup failed to get Ksecdd entropy %08xRNGCryptoSetup failed to open system hive key %08xExternalEntropyCryptoSetup failed to write entropy into the system hive %08xCryptoSetup failed to close system hive key %08xCryptoSetup succeeded writing entropy key\Device\KsecDDWriteCapiMachineGuidCryptoSetup failed get entropy from ksecdd for CAPI machine guid %08x%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xCryptoSetup failed to convert CAPI machine guid to string %08xMicrosoft\CryptographyCryptoSetup failed get open/create reg key for CAPI machine guid %08xMachineGuidCryptoSetup failed get write CAPI machine guid %08xCryptoSetup assigned CAPI machine guid "%s"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@91/301@29/23

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D041FA GetLastError,FormatMessageW,

18_2_00D041FA

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CF2010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		18_2_00CF2010
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CF1A0B AdjustTokenPrivileges,CloseHandle,		18_2_00CF1A0B

Source: C:\Users\user\Desktop\random.exe

5_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CFDD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

18_2_00CFDD87

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_004024FB CoCreateInstance,

5_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D03A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

18_2_00D03A0E

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\VLCKWN88.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_03

Source: C:\Users\user\Desktop\random.exe

File created: C:\Users\user~1\AppData\Local\Temp\nssFAFC.tmp

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000017.00000002.1887991466.0000504C003B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metrics(id INTEGER PRIMARY KEY NOT NULL,event_timestamp INTEGER NOT NULL,ukm_source_id INTEGER NOT NULL,url_id INTEGER NOT NULL,event_id INTEGER NOT NULL,event_hash TEXT NOT NULL,metric_hash TEXT NOT NULL,metric_value INTEGER NOT NULL)v;LP8
Source: chrome.exe, 00000017.00000002.1889754625.0000504C007B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: l6890zc2d.18.dr, k6fcj58y5.18.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: random.exe	ReversingLabs: Detection: 18%
Source: random.exe	Virustotal: Detection: 18%

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\user\Desktop\random.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2300,i,1733554593946630955,15857964922847861043,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2284,i,12414391381378636223,8837719103510671385,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6756 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7116 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2300,i,1733554593946630955,15857964922847861043,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2560 --field-trial-handle=2284,i,12414391381378636223,8837719103510671385,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6756 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7116 --field-trial-handle=1996,i,17426545529985214943,7287810298347379423,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cryptosetup.pdbGCTL source: Avoiding.com, 00000012.00000002.2445490518.0000000004640000.00000004.00000800.00020000.00000000.sdmp, fctr1d.18.dr
Source:	Binary string: cryptosetup.pdb source: Avoiding.com, 00000012.00000002.2445490518.0000000004640000.00000004.00000800.00020000.00000000.sdmp, fctr1d.18.dr

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406328

Source: random.exe

Static PE information: real checksum: 0xfd7f5 should be: 0xfdb14

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB264F push ds; retf		18_2_00CB266E
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB0DE6 push ecx; ret		18_2_00CB0DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File created: C:\ProgramData\dbi5x\fctr1d			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

File created: C:\ProgramData\dbi5x\fctr1d

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

File created: C:\ProgramData\dbi5x\fctr1d

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D226DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		18_2_00D226DD
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CAFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		18_2_00CAFC7C

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_18-103724

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Dropped PE file which has not been started: C:\ProgramData\dbi5x\fctr1d

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

API coverage: 3.7 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 2080

Thread sleep count: 67 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_00406301 FindFirstFileW,FindClose,	5_2_00406301
Source: C:\Users\user\Desktop\random.exe	Code function: 5_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFDC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00CFDC54
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00D0A087
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00D0A1E2
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00CFE472
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D0A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_00D0A570
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D066DC FindFirstFileW,FindNextFileW,FindClose,	18_2_00D066DC
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CCC622 FindFirstFileExW,	18_2_00CCC622
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D073D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_00D073D4
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D07333 FindFirstFileW,FindClose,	18_2_00D07333
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CFD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00CFD921

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00C95FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

18_2_00C95FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\36469\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: chrome.exe, 00000017.00000002.1886142422.0000504C00060000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: chrome.exe, 00000017.00000002.1897665470.0000504C01198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Web Data.30.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data.30.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data.30.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: chrome.exe, 00000017.00000002.1891755954.0000504C00AC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a64a939f-3a57-4ab2-bc30-fe835b441e51
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004544000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 0000001C.00000003.1937069625.0000316C00350000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: chrome.exe, 00000017.00000002.1891755954.0000504C00AC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a64a939f-3a57-4ab2-bc30-fe835b441e51PL
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.30.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: chrome.exe, 00000017.00000002.1891755954.0000504C00AC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a64a939f-3a57-4ab2-bc30-fe835b441e51PL
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data.30.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: msedge.exe, 0000001C.00000002.1950224586.000001E819A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.30.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.30.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.30.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data.30.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.30.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data.30.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Web Data.30.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.30.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: chrome.exe, 00000017.00000002.1891755954.0000504C00AC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a64a939f-3a57-4ab2-bc30-fe835b441e51
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Web Data.30.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.30.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data.30.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.30.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: chrome.exe, 00000017.00000002.1880801902.00000238BA638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^^

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00D0F4FF BlockInput,

18_2_00D0F4FF

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00C9338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

18_2_00C9338B

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406328

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CB5058 mov eax, dword ptr fs:[00000030h]

18_2_00CB5058

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CF20AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

18_2_00CF20AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CC2992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00CC2992
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB0BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00CB0BAF
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB0D45 SetUnhandledExceptionFilter,	18_2_00CB0D45
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00CB0F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00CB0F91

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

18_2_00CF1B4D

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00C9338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

18_2_00C9338B

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CFBBED SendInput,keybd_event,

18_2_00CFBBED

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CFECD0 mouse_event,

18_2_00CFECD0

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user~1\AppData\Local\Temp\36469\Avoiding.com" & rd /s /q "C:\ProgramData\dbi5x" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CF14AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

18_2_00CF14AE

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CF1FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

18_2_00CF1FB0

Source: Avoiding.com, 00000012.00000002.2443203942.0000000000D53000.00000002.00000001.01000000.00000009.sdmp, Avoiding.com.7.dr, Ventures.14.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Avoiding.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CB0A08 cpuid

18_2_00CB0A08

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CEE5F4 GetLocalTime,

18_2_00CEE5F4

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CEE652 GetUserNameW,

18_2_00CEE652

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Code function: 18_2_00CCBCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

18_2_00CCBCD2

Source: C:\Users\user\Desktop\random.exe

Code function: 5_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

5_2_00406831

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Avoiding.com PID: 2980, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Avoiding.com, 00000012.00000002.2443414058.0000000001143000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: electrum.*
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Avoiding.com, 00000012.00000002.2444410333.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Avoiding.com, 00000012.00000002.2444410333.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3 Wallet
Source: Avoiding.com, 00000012.00000002.2443414058.0000000001143000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ethereum.*
Source: Avoiding.com, 00000012.00000002.2444151472.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: Avoiding.com, 00000012.00000002.2444410333.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Avoiding.com, 00000012.00000002.2444410333.0000000001641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Avoiding.com, 00000012.00000002.2445087634.0000000004561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Avoiding.com	Binary or memory string: WIN_81
Source: Avoiding.com	Binary or memory string: WIN_XP
Source: Ventures.14.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Avoiding.com	Binary or memory string: WIN_XPe
Source: Avoiding.com	Binary or memory string: WIN_VISTA
Source: Avoiding.com	Binary or memory string: WIN_7
Source: Avoiding.com	Binary or memory string: WIN_8

Source: Yara match

File source: Process Memory Space: Avoiding.com PID: 2980, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Avoiding.com PID: 2980, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D12263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		18_2_00D12263
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Code function: 18_2_00D11C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		18_2_00D11C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 Software Packing	NTDS	27 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	18%	ReversingLabs
random.exe	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\dbi5x\fctr1d	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.185.78	true	false	high
ax-0001.ax-dc-msedge.net	150.171.30.10	true	false	high
a416.dscd.akamai.net	2.22.242.105	true	false	high
t.me	149.154.167.99	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
gobore.sbs	116.202.5.153	true	true	unknown
play.google.com	142.250.185.238	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
www.google.com	142.250.186.100	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.33	true	false	high
e28578.d.akamaiedge.net	2.23.209.45	true	false	high
assets.msn.com	unknown	unknown	false	high
DGGKjBirXBdcY.DGGKjBirXBdcY	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients2.googleusercontent.com/crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false	high
https://c.msn.com/c.gif?rnd=1738167617136&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=8ad1eb9ee7d249df80d48e36b45373ca&activityId=8ad1eb9ee7d249df80d48e36b45373ca&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://sb.scorecardresearch.com/b?rn=1738167617136&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27F6FBCECCB8627D1201EE4DCD1063CA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	false	high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	false	high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000017.00000002.1886192918.0000504C00078000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000017.00000002.1891528779.0000504C00A80000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/J	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000017.00000002.1889992469.0000504C007E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888290996.0000504C004F0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4633	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/284462263	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/:	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000017.00000002.1891111339.0000504C00A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887819451.0000504C0038B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890996057.0000504C009F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7714	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://unisolated.invalid/	chrome.exe, 00000017.00000002.1891155488.0000504C00A20000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/yq	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/Xr	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/chrome/tips/	chrome.exe, 00000017.00000002.1890496482.0000504C008A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890888028.0000504C009A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/?lfhs=2	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6248	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000017.00000003.1842889756.0000504C013B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841228964.0000504C01458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841401296.0000504C01468000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1841871614.0000504C01434000.00000004.00000800.00020000.00000000.sdmp	false	high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	false	high
https://outlook.office.com/mail/compose?isExtension=true	33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	false	high
http://anglebug.com/6929	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5281	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/ir	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/255411748	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://csp.withgoogle.com/csp/gws/cdt1rj	chrome.exe, 00000017.00000002.1893104398.0000504C00D14000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000017.00000002.1888328065.0000504C00508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890321952.0000504C00830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896715144.0000504C010D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1890207365.0000504C0081C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7246	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/lr	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7489	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/Kr	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/?q=	chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	chrome.exe, 00000017.00000002.1888218674.0000504C004EB000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000002.1960411399.0000316C00020000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000017.00000002.1887819451.0000504C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815546592.0000504C00F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816855301.0000504C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817419183.0000504C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1893772682.0000504C00D88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816713947.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815397340.0000504C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816781948.0000504C007BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816803743.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817037113.0000504C0040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815466580.0000504C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815618900.0000504C01080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817267086.0000504C01110000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1815500708.0000504C010B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Avoiding.com, 00000012.00000002.2447051221.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, p8glx4.18.dr, l6890z.18.dr, Web Data.30.dr	false	high
http://www.autoitscript.com/autoit3/X	Avoiding.com, 00000012.00000002.2443368428.0000000000D65000.00000002.00000001.01000000.00000009.sdmp, Avoiding.com.7.dr, Ventures.14.dr	false	high
https://issuetracker.google.com/161903006	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Avoiding.com, 00000012.00000002.2445925474.0000000004759000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888218674.0000504C004DC000.00000004.00000800.00020000.00000000.sdmp, l6890z.18.dr	false	high
https://excel.new?from=EdgeM365Shoreline	33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	false	high
https://www.google.com/Chartk3	chrome.exe, 00000017.00000002.1890368543.0000504C00854000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000017.00000002.1889992469.0000504C007E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896221019.0000504C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888290996.0000504C004F0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3078	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7553	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5375	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5371	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/Jq	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4722	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000017.00000002.1888369726.0000504C0052C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1896566374.0000504C010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889754625.0000504C007A4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7556	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chromewebstore.google.com/	chrome.exe, 00000017.00000002.1886969010.0000504C0018C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000002.1960411399.0000316C00020000.00000004.00000800.00020000.00000000.sdmp, manifest.json.30.dr	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Avoiding.com, 00000012.00000002.2445087634.0000000004632000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000012.00000002.2445490518.00000000046E7000.00000004.00000800.00020000.00000000.sdmp, q16f3w.18.dr	false	high
https://clients4.google.com/chrome-sync	chrome.exe, 00000017.00000002.1887125521.0000504C001C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000017.00000003.1844628396.0000504C014C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 0000001C.00000003.1941394400.0000316C00284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1941271285.0000316C00280000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6692	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/258207403	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3502	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com	33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	false	high
http://anglebug.com/3625	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://outlook.live.com/mail/0/	33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp.30.dr	false	high
http://anglebug.com/3624	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/J	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/vr	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5007	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000017.00000002.1887909821.0000504C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/Ur	chrome.exe, 00000017.00000003.1847043926.0000504C01620000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1847003486.0000504C0160C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3862	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000017.00000003.1812530922.0000504C004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1817511822.0000504C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1813599706.0000504C00EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810985233.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1816342058.0000504C00D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1814361597.0000504C00EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1818933483.0000504C00D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1812503297.0000504C00CF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1888218674.0000504C004EB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4836	chrome.exe, 00000017.00000003.1810376945.0000504C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1892602825.0000504C00C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000003.1810408476.0000504C00B40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/issues/166475273	msedge.exe, 0000001C.00000003.1942213870.0000316C0038C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000017.00000002.1892767455.0000504C00C6C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/:	chrome.exe, 00000017.00000003.1806171890.0000504C00718000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000017.00000002.1889345770.0000504C00729000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreWYQ1qDqU=	chrome.exe, 00000017.00000002.1889011943.0000504C006AC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://msn.com/	msedge.exe, 0000001C.00000002.1966230479.0000316C003A4000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	plus.l.google.com	United States	15169	GOOGLEUS	false
23.200.88.35	unknown	United States	16625	AKAMAI-ASUS	false
2.22.242.105	a416.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
20.189.173.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.203.85	unknown	United States	20940	AKAMAI-ASN1EU	false
150.171.30.10	ax-0001.ax-dc-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
116.202.5.153	gobore.sbs	Germany	24940	HETZNER-ASDE	true
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
2.23.209.45	e28578.d.akamaiedge.net	European Union	1273	CWVodafoneGroupPLCEU	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
18.173.219.111	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.238	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1602201
Start date and time:	2025-01-29 15:21:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@91/301@29/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 72 Number of non-executed functions: 306
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.185.131, 142.250.185.110, 142.250.110.84, 142.250.184.238, 142.250.186.174, 142.250.186.163, 172.217.16.138, 172.217.23.106, 216.58.212.170, 142.250.185.202, 142.250.181.234, 172.217.16.202, 142.250.185.138, 216.58.206.42, 142.250.185.234, 142.250.186.74, 142.250.186.42, 142.250.185.74, 142.250.185.106, 216.58.206.74, 142.250.185.170, 172.217.18.10, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.185.142, 13.107.6.158, 20.93.72.182, 88.221.110.195, 88.221.110.242, 2.21.65.154, 2.21.65.132, 2.21.65.153, 2.19.126.157, 2.19.126.141, 142.251.41.3, 142.250.65.195, 142.250.80.99, 13.107.246.61, 4.245.163.56, 4.175.87.197, 184.28.90.27, 94.245.104.56, 40.126.31.71, 13.91.222.61, 104.117.182.41, 23.40.179.38, 13.107.246.38, 150.171.28.10
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, time.windows.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, redirector.gvt1.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, th.bing.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, th.bing.com.edgekey.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, p-th.bing.com.trafficmanager.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, prod-ag
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:22:07	API Interceptor	1x Sleep call for process: random.exe modified
09:22:11	API Interceptor	4x Sleep call for process: Avoiding.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.88.35	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
23.200.88.35	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
2.22.242.105	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse
	Message.eml	Get hash	malicious	Unknown	Browse
	jmkykhjksefkyt.exe	Get hash	malicious	Vidar	Browse
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (3).zip	Get hash	malicious	Unknown	Browse
	vXn4pan2US.exe	Get hash	malicious	Unknown	Browse
	vXn4pan2US.exe	Get hash	malicious	Unknown	Browse
	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
	FACTUR@484859 - 345677890A.eml	Get hash	malicious	Unknown	Browse
	https://nekofile.eu.org/f8e2cb54931bf39d6c12eo5nc	Get hash	malicious	Unknown	Browse
	wechat-3.9.7-installer_ae-GFz1.exe	Get hash	malicious	PureLog Stealer	Browse
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
20.189.173.10	Approval Request.eml	Get hash	malicious	Unknown	Browse
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse
	01142025.eml	Get hash	malicious	Unknown	Browse
	DownloadedMessage.zip	Get hash	malicious	HTMLPhisher	Browse
	https://indiollanero7nudos.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse
	https://merzcon-my.sharepoint.com/:f:/g/personal/cnico_merzcon_onmicrosoft_com/EmjHG5K9dP9BtgBBeTTFhjABJRRLGM6IhVrJlwBTMWY8rg?e=pfkS1f	Get hash	malicious	Unknown	Browse
	Message_2533705.eml	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a416.dscd.akamai.net	el.msi	Get hash	malicious	Unknown	Browse	2.19.126.145
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse	2.19.126.152
	installer.msi	Get hash	malicious	Unknown	Browse	2.19.11.98
	NRKCZ1PSDM.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	2.19.11.98
	random.exe	Get hash	malicious	Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Vidar	Browse	2.16.168.113
	random.exe	Get hash	malicious	Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	2.16.168.113
	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	Message.eml	Get hash	malicious	Unknown	Browse	2.22.242.105
	Benzene.exe	Get hash	malicious	Unknown	Browse	2.22.242.11
	x9Lh8czsmo.exe	Get hash	malicious	Vidar	Browse	2.19.11.100
ax-0001.ax-dc-msedge.net	https://wetransfer.com/downloads/37e08bc1e4a62eb00a6c11fe761155d520250129120814/ee7e1c7a1d76e81755a5690158a6b44220250129120814/115061?t_exp=1738411694&t_lsid=7a88a57f-b109-449d-b6f1-2d4191470201&t_network=email&t_rid=YXV0aDB8Njc5MjYzYThhM2FkOGU2ZGMzY2FlZmNm&t_s=download_link&t_ts=1738152494&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse	150.171.30.10
	1011cc-8666df0b-7ef.vbs	Get hash	malicious	Unknown	Browse	150.171.29.10
	https://forms.office.com/e/UfhfB5zRti	Get hash	malicious	HTMLPhisher	Browse	150.171.29.10
	https://redbooth.com/d/59c5a2f8a26f8c49	Get hash	malicious	Unknown	Browse	150.171.29.10
	https://www.cognitoforms.com/StChristopher3/Ankerl%C3%B8kkenEquipmentAS	Get hash	malicious	HTMLPhisher	Browse	150.171.30.10
	1p54HI6W9T.exe	Get hash	malicious	Unknown	Browse	150.171.30.10
	https://flowto.it/eiMIf2Gvo7?fc=0	Get hash	malicious	Unknown	Browse	150.171.30.10
	FACTURE+DOC - FICHIER.eml	Get hash	malicious	Unknown	Browse	150.171.29.10
	Setup.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	150.171.30.10
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	150.171.29.10
chrome.cloudflare-dns.com	el.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	installer.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	installer.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	NRKCZ1PSDM.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	172.64.41.3
	ATT78490.html	Get hash	malicious	Unknown	Browse	172.64.41.3
	random.exe	Get hash	malicious	Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Stealc, Vidar	Browse	162.159.61.3
	SysDrive.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	hmm_dec.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Original Shipping Docs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Inv#9500009424.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	payment reciept.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Receipt Copy001pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://kk.pearlstorehouse.net/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Neue_eFax_Benachrichtigung_mit_kompletten_Details_vom_Wednesday, January 29, 2025.shtml	Get hash	malicious	Unknown	Browse	149.154.167.220
	Top Urgent EFT Remittance for Due Invoice CONOCOIL.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ORDER #24131.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	main.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
AKAMAI-ASUS	random.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://wetransfer.com/downloads/37e08bc1e4a62eb00a6c11fe761155d520250129120814/ee7e1c7a1d76e81755a5690158a6b44220250129120814/115061?t_exp=1738411694&t_lsid=7a88a57f-b109-449d-b6f1-2d4191470201&t_network=email&t_rid=YXV0aDB8Njc5MjYzYThhM2FkOGU2ZGMzY2FlZmNm&t_s=download_link&t_ts=1738152494&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse	2.19.126.136
	https://trycatchdebug.net/news/1125691/optimizing-loop-performance-in-gcc	Get hash	malicious	Unknown	Browse	2.19.224.32
	el.msi	Get hash	malicious	Unknown	Browse	23.57.90.142
	Statement 01-28-25.xlsx	Get hash	malicious	Unknown	Browse	2.19.126.83
	Statement 01-28-25.xlsx	Get hash	malicious	Unknown	Browse	184.28.90.27
	telnet.sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	23.3.160.1
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse	2.19.126.152
	http://steamcommunttiy.com/activation=Tvc2Fh13mw10	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steam.suzhouren.cn/	Get hash	malicious	Unknown	Browse	104.102.49.254
AKAMAI-ASN1EU	el.msi	Get hash	malicious	Unknown	Browse	23.209.72.36
	Statement 01-28-25.xlsx	Get hash	malicious	Unknown	Browse	95.100.110.30
	Statement 01-28-25.xlsx	Get hash	malicious	Unknown	Browse	2.22.242.9
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse	23.44.201.15
	http://anythingwithplants.com/	Get hash	malicious	Unknown	Browse	95.101.148.59
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	23.215.35.19
	http://steamcommunttiy.com/activation=Tvc2Fh13mw10	Get hash	malicious	Unknown	Browse	95.101.149.47
	https://steam.suzhouren.cn/	Get hash	malicious	Unknown	Browse	95.101.149.47
	https://metamaskloginesa.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	2.21.65.141
	https://mettamssklogine.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	95.100.110.23

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SIP_20252701.bat.exe	Get hash	malicious	MassLogger RAT, XRed	Browse	116.202.5.153 149.154.167.99
	MaxxAudioAPO.Dll.dll	Get hash	malicious	Latrodectus	Browse	116.202.5.153 149.154.167.99
	driverpack-17-online.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	New purchase order.jse	Get hash	malicious	FormBook	Browse	116.202.5.153 149.154.167.99
	FA25000003_PDF.exe	Get hash	malicious	Snake Keylogger	Browse	116.202.5.153 149.154.167.99
	!!!.lnk	Get hash	malicious	Kimsuky	Browse	116.202.5.153 149.154.167.99
	SimpleManual.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	oracleSuper.exe	Get hash	malicious	Stealc, Vidar	Browse	116.202.5.153 149.154.167.99
	WindowsSecurityUpdate.js	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	WindowsSecurityUpdate.js	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\dbi5x\fctr1d	2E02vIiMfd.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Vidar	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse
	test.hta	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	Setup.msi	Get hash	malicious	Vidar	Browse
	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\dbi5x\4o8yuk

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08441928760034874
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
MD5:	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
SHA1:	14DFBE9B28D033542357D98005239D842A16FCFD
SHA-256:	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
SHA-512:	DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\6f3e37

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.861537145678193
Encrypted:	false
SSDEEP:	48:22e8v+phDgrcHreIg/0xJ9U3C0gcj0kqIg/0xJuX:22CphPHyx0ruS0N0kqx0rQ
MD5:	6F0056EC818D4FC20158F3FF190D6D6A
SHA1:	9E2108FE560CC2187395C5EED011559D201CE45D
SHA-256:	2F9596801DBE57D73C292BE4F93BD0C05F6D0A44C7A45F5F03FDBE35993B7DEC
SHA-512:	72C193919EC4402D430CCBCC4F9A9B25DC9AAECBCCAEE666EFE20DA4133964D2382F1090EEB8FB0A3073ACAA7825AF7A62B59447D29F912A19BD4C04CDDF1AD1
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-CertificateAuthority-Enrollment-ServerUpgrade".. processorArchitecture="".. version="1.0.0.0".. versionScope="nonSxS".. />.. <migration.. alwaysProcess="yes".. replacementSettingsVersionRange="0".. replacementVersionRange="6.1.".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\Software\Microsoft\ADCS\CES [ConfigurationStatus]</pattern>.. </objectSet>.. </include>.. </rules>.. <rules context="System">.. <detects>.. <detect>.. Detection of CES. -

C:\ProgramData\dbi5x\d2nyc2

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10219
Entropy (8bit):	4.966520026409024
Encrypted:	false
SSDEEP:	96:NPgBOOzJMk67cY82SGrPVYRjDjXK2F6KJzLLwGXtXqWgrjj31jj6OzJMk67cY82s:UYwP62I+Wr3JjkwP62I+Ws
MD5:	381138FA1B1C4C298AD2441898677ED6
SHA1:	B8A0B0ECAAF6F3BBD7C27DD54ACD4BC3366DD0A4
SHA-256:	D4EE07BC2183E3D013B68B080B9E2F603676B27F8B0C95CCA2ED533BC671FAFA
SHA-512:	095C2B1C129C36125FE17ED096FDE58AE0F8AF61527D9AEDCAB379C3221BF09D87F28846E6FA3CF9FE05C750689A2ADFCDD1AB67409780A12A425A33219858EC
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. <assemblyIdentity.. buildType="release".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI-Component".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. optimizePatterns="no".. offlineApply="no".. replacementSettingsVersionRange="0".. replacementVersionRange="6.2-10.0".. scope="MigWiz,Upgrade".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. Downlevel settings -->.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsof

C:\ProgramData\dbi5x\djwl6p

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.0065780470180306
Encrypted:	false
SSDEEP:	24:p/o2e8GFp8PvMu0Vnu7vFPvJ8+FXg0Mej39ImlQu/kKcCEF4wflBX0FCUK:22e8+8PvMu0VnuRPvJ8+FXgMtImlx3cd
MD5:	E68A33BDAF7AEBE6D5BBBCEFDED6AC5C
SHA1:	A1120341BB4452FCA47EB5EA8FA62A08BFC48073
SHA-256:	A5DC5B9F31D69E6F65F405EF4E187BAB262746AAAC08E95C195AA77A0B310DE1
SHA-512:	69E1A60C0FFE8AA19B55FABE47801EEEA7CF4C84E426318D8B7BFFAF09A14FC5F569573BE30753D354B604911A616C231F485B08C3778E0A214F7E3DC9C21D2C
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="artbaker".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="artbaker".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Cryptography-CryptoConfig-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration xmlns="">.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>..

C:\ProgramData\dbi5x\dt0r1d

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	5.059776328378613
Encrypted:	false
SSDEEP:	96:22CBzmeQiHRAQgXx9QgXcOaBIpghKkQlwYBwkbsgo9:MmCZy7BhA
MD5:	3A9306662FE93D09B05B9AE44128BCF1
SHA1:	77A917FFE8FF0EAAD8F3D3B764836C810E4C9DF5
SHA-256:	1988183ECBC3C6987DA9CB598C78B52D7563D995FA94D1E91E0470392E765374
SHA-512:	DA1F2776E8D1E08076032365B0D463DC847A31C6C360181D9966488455E878C7738DEC6F2B39153B2A410E3BEB73A05EB524593D125077273343740826A7B9F9
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-dpapi-keys".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. scope="Upgrade,MigWiz,USMT,Data".. settingsVersion="1".. replacementSettingsVersionRange="0" .. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect [CREDHIST]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect\ [Preferred]</pattern>.. </objectSet>.. </include>.. <merge script="MigXmlHelper.DestinationPriority()">.. <objectSet>..

C:\ProgramData\dbi5x\ek689r

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\f3ekn7

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.016955029110262
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+Vj3Xg0cjAkt3QbENgwnwJXMFhUK:22e8v+VrgfAbIggwJuX
MD5:	2948FF1C0804EC7DB473BB77EB3FBE4E
SHA1:	98A97AFC0E4E2B09A17AA0746F455DFD24356357
SHA-256:	2F6B99F5915A462CAFF60950839E1498F12C9F8194DB3DA02251C5BD2CAD700E
SHA-512:	8393B3AE7D44A4DD85D05D48768F9123910E603C477A3CACC6BF12D03D464959EC01A293B0B3317B0F8470A76D71F695098AE211DD6200D8F7F21E1C757F4EDA
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Security-NGC-PopKeySrv".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. offlineApply="no".. scope="Upgrade,Data".. settingsVersion="3".. replacementSettingsVersionRange="0-2" .. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Ngc\ [*]</pattern>.. </objectSet>.. </include>.. </rules>.. </migXml>.. </migration>..</assembly>..

C:\ProgramData\dbi5x\fctr1d

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24008
Entropy (8bit):	6.062446965815151
Encrypted:	false
SSDEEP:	192:GKODczWz9IdqYbN9h+rKipXKuS28xb3HWJvah46Flkzl2W4FWEWSawTyihVWQ4e1:6DiWzGG+mKlxb32JyczEW4FWdwGyUlI
MD5:	6AEAEBF650EFC93CD3B6670A05724FE8
SHA1:	A4FE07E6C678AC8D4DC095997DB5043668D103B4
SHA-256:	C86891B9DF9FEEA2E98F50C9950CB446DB97A513AF0C23810F7CA818A6187329
SHA-512:	5C7E8C7DBAEB22956C774199BAD83312987240D574160B846349C0E237445407FF1CAACD2984BFAD0BBBE6011CC8918AF60A0EBBE82A8561CAFA4DF825ADD183
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2E02vIiMfd.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 25xTHcaF7V.exe, Detection: malicious, Browse Filename: test.hta, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: script.ps1, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse Filename: nB52P46OJD.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q..E...S..E...]..Q..t..E...Z..E...P..E...S..E.S.P..E...P..RichQ..................PE..d....Q.!..........",.........$......................................................Bn....`A.........................................<..X....<..x....p..(....`..h....<...!......(....8..T............................0..............(1..0............................text...p........................... ..`.rdata..>....0......................@..@.data...`....P.......0..............@....pdata..h....`.......2..............@..@.rsrc...(....p.......4..............@..@.reloc..(............:..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\gdbi5p

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\i5p8gd

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.925445222257812
Encrypted:	false
SSDEEP:	48:227+9gUKl+lxFcCY4/YBu4yTy3opyLyXyoyOyzylpjyA:22Sw+lxaWm3uCL9Gv
MD5:	60145F68B1CF9440FA663820AE11CE4B
SHA1:	10195A2926015E3024D769673E004AA60DFEC0A3
SHA-256:	4805E01EB0C9B3DFEB6B754D4148588E2FB798734D9EDE20E53EB8E75158B64F
SHA-512:	55D088040D25D4CBFF5A4210A85107666E628C67CA3134B0C836E135DBFE82AA4FA70185993E99D951307F7D159C1428B390727DA17EFEC5AA4BE9D799B96895
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="".. name="Microsoft-Windows-Kerberos-Key-Distribution-Center-DL".. processorArchitecture="".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. version="0.0.0.0".. />.. <migration>.. <machineSpecific>.. <migXml xmlns="">.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>.. <detect>.. <condition>MigXmlHelper.IsOSEarlierThan("NT", "6.0.0.0")</condition>.. </detect>.. </detects>.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\kdc\* [*]</pattern>.. </objectSet>.. </include>.. <exclude>.. <objectSet>.. <pattern type="Reg

C:\ProgramData\dbi5x\k6fcj58y5

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\l6890z

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\l6890zc2d

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\my58gd

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	5.027484893998515
Encrypted:	false
SSDEEP:	96:WNPERXr2q6QOOzJMk67cY8GrPVYRjDjXK2FJpjjsjwjZjj6OzJMk67cY8GrPVYRM:a2gwP625sQ9jsw902I
MD5:	2D6ACF2AEC5E5349B16581C8AE23BF3E
SHA1:	0AA7B29E8F13EB16F3DFC503D4E8CC55424ECB15
SHA-256:	B48F54A1F8A4C3A25D7E0FBCB95BF2C825C89ACD9C80EBACE8C15681912EDEA2
SHA-512:	7943AA852F34778B9197C34E6B6978FE51E0CDD2130167CB9C7C56D1B2B1272051EFE03DF3A21A12ECB9B9303DE0733E335CDE0BBBE1A1FC429E3323D335A1FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. AuthUI has 3 different component names that matter in its migration story... The one that applies during the migration gather phase is as follows:.. Microsoft-Windows-Authentication-AuthUI: Vista and Win7.. Microsoft-Windows-Authentication-AuthUI-Component: Win8 (and beyond).. In order to support migration from Vista/Win7 to Win8, we update the Microsoft-Windows-Authentication-AuthUI component.. to gather in the MigWiz scope (in addition to the Upgrade scope, which it already supported)... -->.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration .. optimizePatterns="no".. offlineApply="no".. alwaysProcess="yes".. scope="MigWiz,

C:\ProgramData\dbi5x\p8glx4

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652430223787965
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMJSAELyKOMq+8HKkjucswRv8p3nVumu:K0q+n0JJ9ELyKOMq+8HKkjuczRv89S
MD5:	6110075305294E35AF2A0C724CFCD3A0
SHA1:	8F793D1FB960ABE486C088E1ED55540A16A5D8A0
SHA-256:	EB348CA055BAC941DE62C6EA7A0BEDE4737F3EEAE5F186DDCEC752F0F4DD3822
SHA-512:	DCD9CFFAA9C1B32DBAF10070202EF328070BF6ED2A7BC37ECD6A68A9ADAF927291B103019E18B8E807F02B727248C46A60DAA34D6449EC080DBB853A5EE61F79
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\pp8q9r

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\dbi5x\q16f3w

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\dbi5x\r9zmgl

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.120077314818075
Encrypted:	false
SSDEEP:	48:22e8T8PvMu0846PYPvJ8+F9gUUL0VlxfMUIgPdunPduZJ0gPdunPduZQ/+lx3cCQ:22X8PvMu0LtPvJPF+0VlVO0z60w+lfah
MD5:	C7E301D9DD77A21C1CDBD73A63AF205C
SHA1:	715D25AA0C06B2AD162F52A8DE06FB5040C389B1
SHA-256:	239C9A49ACDA9FC9845B87819A33D07F359803153FEFFE4D2212989F82DE71E1
SHA-512:	B0E6FFB10EF5EB9EB433A23803591C84F603779306E78B1648374218A50D2F77E8EE7215615E9D1BE033A96B735321FCA9D5F7B0CB65661674346FC1546E43FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:04:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:39:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Crypto-keys-DL".. processorArchitecture="*".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <migXml xmlns="">.. Check as this is only valid for down-level OS < t

C:\ProgramData\dbi5x\s00r9r

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\dbi5x\u37g4w

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3019
Entropy (8bit):	4.884926762491409
Encrypted:	false
SSDEEP:	48:22e8z2j+YgfH0LeIg6aFnJmINGbYgaFnQ7sPvh27+QgL7sYN2b4waFnw+:22X2qD0SPJv1/Pvh2S/pVN
MD5:	63F04FB9936532B21E616E88E3EBED14
SHA1:	56CEC96A0D4B10C6FC28C726B76BEF278CBC512F
SHA-256:	61C5B3D0FD4051236AD00A0A39BE2F75F7E0DEC2AFBFF85617AED19AEF3FC650
SHA-512:	66FF4756CE723378126DC6C1EC493B665D08387B3305A97ED9A80500CCCE6001DFB7F8957E8246C7C572D0362DA49EEC7AF8451B849F9E0E89FD8E14041CE75D
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Extensible-Authentication-Protocol-Host-Service".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0".. replacementVersionRange="6.0-6.1.7150".. scope="Upgrade,MigWiz,USMT".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Configuration\

C:\ProgramData\dbi5x\vkfkno

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	5.1021772201912805
Encrypted:	false
SSDEEP:	96:22X8PvMu0jPvJPM0UJl1/Qi9XexcElVOaBIpgmQlwYBwkbsgobVu:MUnZUb1xXMV37BhgVu
MD5:	477F010FDB6BD5E5E57D6DEC5449F2FB
SHA1:	73F9C03AF35B29EC2404BB70FEDC8C9ADADE74F6
SHA-256:	2DBEDD5D4D6645E9ED45563FDB1DC42387EF24C9CF5D6A08EC3BE448073C4696
SHA-512:	3C630BE96FC7FCD0036D254BA4D197AB31F37F6DAC411F8C78E624B0501D0205AF36CD5A29EC98D96D5D8D88EF2DBB2DF3A62C6F658A93302ECA500B8EC74F2F
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-dpapi-keys-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows V

C:\ProgramData\dbi5x\yuknyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.976174799333973
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+UX6g0cj3+3A63sDEF4wwVpQwuoMBX0FCUK:22e8v+DgfLUwY4fcZB2A
MD5:	ECC51190BD585AB376691BBDDF2A638B
SHA1:	84DE01CF25B71C0BC4D16FAF65BE1589E385EAF0
SHA-256:	6F15C7E90A3C414BEAD4C1C50DC5E7CAB987D72E2F49953B717A879D7745038C
SHA-512:	C0626F92BD934A3C5295EA32D63910C3F51E0A47CB6287C698C0DF7EE66C1D1A1867FDE10F824BD7514566C69CD2DA16571D3F0DC56FE9DE39D13F89DFE2A02A
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Embedded-KeyboardFilterService-Client".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0-1".. settingsVersion="2".. >.. <machineSpecific>.. <migXml xmlns="">.. Per-machine state -->.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\MsKeyboardFilter [Start]</pattern>.. </objectSet>.. </inc

C:\ProgramData\dbi5x\zcject

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dbi5x\zmy5pp

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.96984082363901
Encrypted:	false
SSDEEP:	24:p/o2e8ZF2YS+pg0cjh3N1LRMEF4wuSb3wuyBX0FCUK:22e8z2j+pgfZlMY4Qr0B2A
MD5:	4DBFCA3B87A59186D2612A95CA2CD899
SHA1:	4C84BD2D60CE789B44070CDDC296C09D2F52B1CC
SHA-256:	2C229D8DA31E17FCEF244A8A2029CA8FE8374738A9ECBFED9E23FB89DB8DF059
SHA-512:	704ECDBE3FC38AC3807946072C7C523C36B4AF1586BEFE01A87BBBF35CF20214A0E0DE892A56E74FE8AA806154D7D2B9CC7028AEF47BEC326564B5F18CD12421
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-OneCore-TetheringService".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. replacementSettingsVersionRange="0".. settingsVersion="1".. alwaysProcess="Yes".. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Roaming\[]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Settings\[*]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36f40d4c-ac7d-4d88-bd55-c4fbf0e60f5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44699
Entropy (8bit):	6.094821372667515
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kQBKKGf4IBjjFiwKSN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynR3N7VLyMV/YoskFoz
MD5:	F423396FB7D0C8E280B66343650C3294
SHA1:	C3662AF883F5D8E61E02A7E34542F911D6A52973
SHA-256:	540A35A966A1126D77E25ED18CFC8179F09C688AA3086659AA7ABE39CA17E60E
SHA-512:	1F7C248F2ABF3B1572D2680C00A8E31626734C7409D485F3BA38BC7E270AB7983781A09FEB89E8814982D55468F1C024C999EB3526F3BBA77CAE5F961000FEA8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7130c568-fbd1-47dd-885b-39fc316f8fa1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44777
Entropy (8bit):	6.0951787901526195
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xiBKKGf4IBhoX47vzpN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7yO/9N7VLyMV/YoskFoz
MD5:	0D61EC3B187DBB08EBC19D35F4220ACB
SHA1:	6B07C80481AA1D0E004D0096C66D6A9448347DA7
SHA-256:	2BBE9F7DE9661979791715230AF6F157A6F4E2FBE7E8DB6DD895D85062E47C6B
SHA-512:	B2E132744BC28DA31C7C4DCCFA18AE3E89C4448C553525558E45A4BA00B4F3C6494227FE941DE81DCEDA58864305775248BE3FE47CE64A57FE69EC9DB7481F37
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e29a36c-2c37-400d-900f-3f784de866d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44699
Entropy (8bit):	6.094821372667515
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kQBKKGf4IBjjFiwKSN7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynR3N7VLyMV/YoskFoz
MD5:	F423396FB7D0C8E280B66343650C3294
SHA1:	C3662AF883F5D8E61E02A7E34542F911D6A52973
SHA-256:	540A35A966A1126D77E25ED18CFC8179F09C688AA3086659AA7ABE39CA17E60E
SHA-512:	1F7C248F2ABF3B1572D2680C00A8E31626734C7409D485F3BA38BC7E270AB7983781A09FEB89E8814982D55468F1C024C999EB3526F3BBA77CAE5F961000FEA8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152642343929
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
MD5:	628C9E9C9240CB5D8854F4E737E8E3E1
SHA1:	D42A042A0E06415AA7215728C7F5DE6DF4517DDD
SHA-256:	DEC06B922CB3636605946E641FBEA8A92E9FAE1F1F05ABB4C5A007327D83FF0A
SHA-512:	E0F071D560AA10728058BC0F67A4A210F7BA606873F562429E8C682B495B094AC5F67B5EAE03A7C35638402B7B0A681AFB2DB52CA55622C5BF3A167D16763649
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c915c614-2384-457e-82da-f2af178fbf42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152642343929
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
MD5:	628C9E9C9240CB5D8854F4E737E8E3E1
SHA1:	D42A042A0E06415AA7215728C7F5DE6DF4517DDD
SHA-256:	DEC06B922CB3636605946E641FBEA8A92E9FAE1F1F05ABB4C5A007327D83FF0A
SHA-512:	E0F071D560AA10728058BC0F67A4A210F7BA606873F562429E8C682B495B094AC5F67B5EAE03A7C35638402B7B0A681AFB2DB52CA55622C5BF3A167D16763649
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-679A5538-1B90.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04700724255057594
Encrypted:	false
SSDEEP:	192:p0d0m5tmJnOAUyYjJ8STlGaDrZX/gLXnFXIt8EozTvhN68NAoARQbid9fn8y08TQ:6d0Ut2uHYzbfhdjcT9f08T2RGOD
MD5:	06B6607B74BD7A2E5A30A8520BB59CAA
SHA1:	7A2A5D8220D3376971F395D6BEDD8761198CC200
SHA-256:	0D613CAF818784E5EC8C8949A9BC571367A4A53C19C81048BFDB81992B3FF183
SHA-512:	C00FD17A16DA518146EFF285B3519E51982B1C134E3C9072A77E39813F4DC6BAD287F09A74A7CEE951B152E4D43F29C12136F7357D5FF3668376FEF6253368FE
Malicious:	false
Preview:	...@..@...@.....C.].....@................i...Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".xqhlkc20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-679A5539-1B3C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.43893002398049435
Encrypted:	false
SSDEEP:	3072:q9kva9Wn6Y0WBSQXz+58q8aPUJybGBJC3OyqXQHB598BUoQ3tc8g1HF:fvahADlq8AUJyGOOyqW5986oQ3RaH
MD5:	AA23EE130042BEE5B4D091E5D7AD1D38
SHA1:	B69FE983DFA2B9502398844F5CAE8F36490ED17F
SHA-256:	8D6990FCBE0C9C38D86445CE233492D1F273196E52EAEF09F83477D809B3A829
SHA-512:	1BB2AD69D9DADF602D7DD54658286BDD4763FCC388DC993AFA3E9565658C1AC5E88EDFE233B2A6CF15982F67DE95C9D9FE25A8259F18BE2C617D797496A169B1
Malicious:	false
Preview:	...@..@...@.....C.].....@................b...b..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".xqhlkc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0639176c-b306-4dcb-a8b8-0ead67aec652.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561405716467664
Encrypted:	false
SSDEEP:	768:bjDtky7pLGL7h3WPD/fdH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLVu7j0rwnZw/A:bjDtkKc7h3WPD/fdHu1jaBLV2jtnZw/A
MD5:	B82A63673CBE9B9813BA02041FFD924C
SHA1:	2CA7740AFCE062851C3566C8260E32DC5BD39E5D
SHA-256:	3DACFDA97EC75D18172F736841E3F09F69229932BB22A6EDE84224B4A1F6B4BD
SHA-512:	4DF27148D73D4B37BD06348A550AE40A072415B887CA566BB4EFAA807A7011C1A0A3B3B44833A4BD7B121A4362A5B7828E3D6490D8397AB37F83AB1E55EE7790
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382641209603749","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382641209603749","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\33510dff-f6e5-4fc9-9df4-4883cac7eb6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\504cbe5b-4d6d-4516-888f-57b38c0d33e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13408
Entropy (8bit):	5.225148223672614
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNP9kemYs5t8JbV+FELQwG3VhPDYJ:st5PGKSu4BstO7tJXWabGgQwMc
MD5:	BE321172D3031C4CEA7A1CBE7E98CB3D
SHA1:	99B48601001CE1F4AE01DD13E1B5486282C3A9F7
SHA-256:	EAB3D028EA95ADD3A5B7E0066DEB8D0EB28AD86AAF8AD68D53647E8FAA56DC42
SHA-512:	ECA414A6041E0894543A44DCDBF4ACDAF92EBB475C843EDAD3A45091E8BBA9BECFF06F4387D0B42E80417E431CD6EBC2AF129F51B709CD01098AC715086BBD18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5c169a7f-10cc-4d7a-a06c-153363d15927.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564270737177121
Encrypted:	false
SSDEEP:	768:bjDtM3WPD/fSH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLVu7j0rwnZP/LqKp5tuX:bjDtM3WPD/fSHu1jaBLV2jtnZP/uUts
MD5:	F89B75A20345024D3335D8FE3953741D
SHA1:	8B1E360DD79E12846E06E23346E1611B6DBD5E91
SHA-256:	51939FC4E72DCE143B453ACB02D18AD93E16D6509BDC62CE4242A487AC17A1DE
SHA-512:	D8F0298849B1BC90C27D56BC8D86791108E87ECC5175D18629592752CBC098A217EDEC5EA924B792711843DF7AE7E115E8D9BF164A1D5EFAC530AD9A96811624
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382641209603749","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382641209603749","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\677eec7d-d420-4e0e-862b-a1cebd460bb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6d5bf170-1ddf-4b83-ac89-18eaf4e57220.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14001
Entropy (8bit):	5.289748224676884
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNPFTvkemYs5t8JbV+FELQwG3VhPDYJ:st5PGKSu4BstO7tJFTpWabGgQwMc
MD5:	DDC7C4F3E1809B027FC853CEBC9B42A4
SHA1:	E7DE71E36B96EF219C518DE98FF1F84E8C5BCF4F
SHA-256:	A1FCDB9ED30CBFE8C2EEF6F53F676527344C985628DC4BEC8DBEFBA9DD97D184
SHA-512:	23FBE4A0DA098D7782C2D88115B676B11704574F95D486D2346A09C5195A3DD4AE622E9A6EC7EF0BDED13197D5F3E918781CF860EA7451BC84D5191781294575
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95a83f99-5635-4fd4-8aaf-7b8796e5d7fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.276139412339881
Encrypted:	false
SSDEEP:	6:iOuKRcXHM1cNwi23oH+Tcwtp3hBtB2KLl8veq2PcNwi23oH+Tcwtp3hBWsIFUv:7uKS2ZYebp3dFL6vevLZYebp3eFUv
MD5:	5842CB1ED30F7709585F3EDAFA1DE3A0
SHA1:	676870B517C206F475B207223D4DB908E9BC3AC9
SHA-256:	D99DDB6C07F7AD16F11018B5DA31F593BB0CF1855BF6519C2003BF6E488316EA
SHA-512:	DD36536F3435539A3089B8EDAEAB4EA83E3D233634A1EB28093672D57B58E6A1B011B77411137AA41015BC4E4374DFFDE96138610F0EF887930F4FB10D63BC59
Malicious:	false
Preview:	2025/01/29-11:20:15.534 b64 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/01/29-11:20:15.588 b64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040633337678883
Encrypted:	false
SSDEEP:	24576:k1f76gGkISshcFdmcOAoPENUpifYP+MbI2T:k1fgAmmE
MD5:	51E3F6B763114F1D200A55340105F678
SHA1:	8194A57B7F4337EB8B21268EB7E53F22A6ECA002
SHA-256:	08F48FD548AF3875D32046FF8582FDAEF4216585D5633DA23F9638688E571DB9
SHA-512:	D5315168AC2B7B42DD58638E6E0BDE25D0242E6325A7051BC47DA79A228256112CB964B630DDED6D23D868EE5877A38BD6FCC28A8693E9EE7076B2322FF2EE7C
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106313060074916
Encrypted:	false
SSDEEP:	6:iOuwuFN+q2PcNwi23oH+Tcwt9Eh1tIFUtMwfEmWZmw6wtkNVkwOcNwi23oH+Tcw+:7uwu3+vLZYeb9Eh16FUtMww/6wSNV54G
MD5:	09A60D11335538375F0D635E7822F921
SHA1:	F4BF2E45027F09B7F1D9CAB3A6988FD63C903F25
SHA-256:	CC7A734C79D40D054F82E0D07E6CEA0C61E422B6BDE53771A4A155047A739662
SHA-512:	832C04B32168CAB69F2A73830C5F7743AB2C8B4657C1E7F55119F4F1AB3D9B189FBB4E914CBCAFB1526E7772667F46187AB7A1E82CAA117B576463A029E0F725
Malicious:	false
Preview:	2025/01/29-11:20:15.265 1b0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/29-11:20:15.267 1b0c Recovering log #3.2025/01/29-11:20:15.272 1b0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.106313060074916
Encrypted:	false
SSDEEP:	6:iOuwuFN+q2PcNwi23oH+Tcwt9Eh1tIFUtMwfEmWZmw6wtkNVkwOcNwi23oH+Tcw+:7uwu3+vLZYeb9Eh16FUtMww/6wSNV54G
MD5:	09A60D11335538375F0D635E7822F921
SHA1:	F4BF2E45027F09B7F1D9CAB3A6988FD63C903F25
SHA-256:	CC7A734C79D40D054F82E0D07E6CEA0C61E422B6BDE53771A4A155047A739662
SHA-512:	832C04B32168CAB69F2A73830C5F7743AB2C8B4657C1E7F55119F4F1AB3D9B189FBB4E914CBCAFB1526E7772667F46187AB7A1E82CAA117B576463A029E0F725
Malicious:	false
Preview:	2025/01/29-11:20:15.265 1b0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/29-11:20:15.267 1b0c Recovering log #3.2025/01/29-11:20:15.272 1b0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.462341513328049
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuF:TouQq3qh7z3bY2LNW9WMcUvBuF
MD5:	CE99654C8A2FD51425CC039182407B02
SHA1:	5151A8D66E9A7DA17DED291E30CED4D07F65A8A1
SHA-256:	D05D125E450279CF504BC7C2AD71132A43B554C07C55BFF84B3391D2D29F4774
SHA-512:	D59EC131DF6FC29E88A24A9BFC1B328703E88E53C59D5389D0FE71A41AF5F22A2AC35CA61D403BE8996F9C62390A9A3DBF1E884F3AA2BB38284596C39A344D0C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.211765121926512
Encrypted:	false
SSDEEP:	6:iOuTLEVq2PcNwi23oH+TcwtnG2tMsIFUtMTLf2Zmw6TLfKkwOcNwi23oH+TcwtnB:7ucvLZYebn9GFUtM/2/6/K54ZYebn95J
MD5:	BDA720464E1FB3B115BFF8AED84A8B7C
SHA1:	0914626E4A7BA6B794386834EA00B222C167627E
SHA-256:	A81C567545C043EBEBB9BC467D89DD903EAB3038A8684BD70465103AA279E4AC
SHA-512:	856B6D5A9985514F434872B29E96181013985461FF4B52D8659E395D876BC5A3B2746620CA03FB03E788505181760F8321A114B254CBD75D7B56E02B3C31F3D2
Malicious:	false
Preview:	2025/01/29-11:20:09.659 b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/29-11:20:09.661 b4 Recovering log #3.2025/01/29-11:20:09.661 b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.211765121926512
Encrypted:	false
SSDEEP:	6:iOuTLEVq2PcNwi23oH+TcwtnG2tMsIFUtMTLf2Zmw6TLfKkwOcNwi23oH+TcwtnB:7ucvLZYebn9GFUtM/2/6/K54ZYebn95J
MD5:	BDA720464E1FB3B115BFF8AED84A8B7C
SHA1:	0914626E4A7BA6B794386834EA00B222C167627E
SHA-256:	A81C567545C043EBEBB9BC467D89DD903EAB3038A8684BD70465103AA279E4AC
SHA-512:	856B6D5A9985514F434872B29E96181013985461FF4B52D8659E395D876BC5A3B2746620CA03FB03E788505181760F8321A114B254CBD75D7B56E02B3C31F3D2
Malicious:	false
Preview:	2025/01/29-11:20:09.659 b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/29-11:20:09.661 b4 Recovering log #3.2025/01/29-11:20:09.661 b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6136753449274626
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jIWDlpJQmL:TO8D4jJ/6Up+0WD
MD5:	9546B4D6282C971C4CE99D8487F8F97D
SHA1:	6CF35F967858427C526120C0CFEA35A61B6C57B5
SHA-256:	5498055AC6C80D90766B416F28152F232899AB34AD5B03A4B72CD0B6F97EB76C
SHA-512:	F406E0FA70D6EB65757CCB6EE75E81AF9CAEF0D9663AC772CDF075C47A8ED05902CF15683E7340F66613D0461767BDF6A648223D011A13E2AA2CA050D5C25B44
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354164632470715
Encrypted:	false
SSDEEP:	6144:IA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:IFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5EF4943642420D9C74E9BE67BD3B3C7F
SHA1:	21B6D5E72019C99EAD1620DFAC01B27D6C1B8DBA
SHA-256:	EC4D8F2EA93E14DB49BA28A4D44C7C936776AFF642070B855A78C426B94BE1E2
SHA-512:	0ED36F5C348EA736D1442F08258EBCC73C558047576D585E208A64D4910280449BABE3012679F851EB86B6AFA82004FD20E39D07D990338CF69B5C1CB92A2BD8
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13382641216873866..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.166740324147903
Encrypted:	false
SSDEEP:	6:iOuwOM1cNwi23oH+Tcwtk2WwnvB2KLl8g5q2PcNwi23oH+Tcwtk2WwnvIFUv:7uwO2ZYebkxwnvFL6g5vLZYebkxwnQF2
MD5:	B3C9345264AAE27A97074DDBD9F83E94
SHA1:	CA487058437374A0946C038287D7A15E7AA7E489
SHA-256:	181E93DECE3AD6393BC3736725C9BDEDF13205B448E5D931ED3FD10B8C2337DE
SHA-512:	16F45D44C4F88CFD94B5530F4EA7705D1F6E0DA0CEEA714873E0D9F2973968A780CA581F9DF7934FB7CA33D8FDF31052956771264EC1574F125333EE59BD10B5
Malicious:	false
Preview:	2025/01/29-11:20:15.289 1c94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/29-11:20:15.345 1c94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246211506302785
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RM:C1gAg1zfvU
MD5:	8B6BC60FB14E84D54124AD2891BE00FE
SHA1:	29B44C5036F1117DB6698AC9E0F1454AD4D03672
SHA-256:	7372DE2A7D7B51053AE9DFEF7E910E3726096421D2C51A163EAF046F335E4845
SHA-512:	15EF4EDD96CCE53DB64E54F0358780191E2CB09D83CE2FFCBD39F3DFF40E99A4AB516EA415688FC1E807606315E921D7D9757465FB6AB68F9B194FA255CDCB7C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2098402209261
Encrypted:	false
SSDEEP:	6:iOuTLdjE7+q2PcNwi23oH+Tcwt8aPrqIFUtMTLdB9Zmw6TLdBBVkwOcNwi23oH+o:7unvLZYebL3FUtMT9/6TP54ZYebQJ
MD5:	13DE6D7B605CE4AB9125088B250B8B4A
SHA1:	4E02677CD1C0ABAA48DE48E0141A59D7623BCD0E
SHA-256:	B1C9778CC2BD2D0A8EDC1A5A92221A392810683ECDB89330260E4CCBF79C34C1
SHA-512:	80182F6A9A57EAB1D85407C4C8089788C71B67065210B1D6B079A34EDA67CDE79BD2D9B4FE0C9336123F3DBB2535101547FFA3A7DC35C94DB8F2E70A1AC16419
Malicious:	false
Preview:	2025/01/29-11:20:09.644 1848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/29-11:20:09.645 1848 Recovering log #3.2025/01/29-11:20:09.645 1848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2098402209261
Encrypted:	false
SSDEEP:	6:iOuTLdjE7+q2PcNwi23oH+Tcwt8aPrqIFUtMTLdB9Zmw6TLdBBVkwOcNwi23oH+o:7unvLZYebL3FUtMT9/6TP54ZYebQJ
MD5:	13DE6D7B605CE4AB9125088B250B8B4A
SHA1:	4E02677CD1C0ABAA48DE48E0141A59D7623BCD0E
SHA-256:	B1C9778CC2BD2D0A8EDC1A5A92221A392810683ECDB89330260E4CCBF79C34C1
SHA-512:	80182F6A9A57EAB1D85407C4C8089788C71B67065210B1D6B079A34EDA67CDE79BD2D9B4FE0C9336123F3DBB2535101547FFA3A7DC35C94DB8F2E70A1AC16419
Malicious:	false
Preview:	2025/01/29-11:20:09.644 1848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/29-11:20:09.645 1848 Recovering log #3.2025/01/29-11:20:09.645 1848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197818337118548
Encrypted:	false
SSDEEP:	6:iOuTLEt+q2PcNwi23oH+Tcwt865IFUtMTLE5Zmw6TLCFE7VkwOcNwi23oH+TcwtD:7ulvLZYeb/WFUtMw/6iSh54ZYeb/+SJ
MD5:	B9B6E9D1AC03D304BDDF529B33F2A2F3
SHA1:	EE5D8F2F0C8B69F2C69B15B39778147E8A5ADE2C
SHA-256:	64F744AF2ADEA1DFF1B0E31A4415D368235116FBC726C78E185D7F14F0272948
SHA-512:	66CC37678F21039828482347BE991DC8C93425A94C2CBA1472D0CD36131C3409CB26AA65F9C19140D5779CA08FA162DC2986ECB7A1C6AB842E0D1FE6D68473B9
Malicious:	false
Preview:	2025/01/29-11:20:09.691 1848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/29-11:20:09.691 1848 Recovering log #3.2025/01/29-11:20:09.692 1848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.197818337118548
Encrypted:	false
SSDEEP:	6:iOuTLEt+q2PcNwi23oH+Tcwt865IFUtMTLE5Zmw6TLCFE7VkwOcNwi23oH+TcwtD:7ulvLZYeb/WFUtMw/6iSh54ZYeb/+SJ
MD5:	B9B6E9D1AC03D304BDDF529B33F2A2F3
SHA1:	EE5D8F2F0C8B69F2C69B15B39778147E8A5ADE2C
SHA-256:	64F744AF2ADEA1DFF1B0E31A4415D368235116FBC726C78E185D7F14F0272948
SHA-512:	66CC37678F21039828482347BE991DC8C93425A94C2CBA1472D0CD36131C3409CB26AA65F9C19140D5779CA08FA162DC2986ECB7A1C6AB842E0D1FE6D68473B9
Malicious:	false
Preview:	2025/01/29-11:20:09.691 1848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/29-11:20:09.691 1848 Recovering log #3.2025/01/29-11:20:09.692 1848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.054220288846833
Encrypted:	false
SSDEEP:	6:iOuSv4q2PcNwi23oH+Tcwt8NIFUtMSvJZmw6SvDkwOcNwi23oH+Tcwt8+eLJ:7uTvLZYebpFUtMG/6654ZYebqJ
MD5:	CD6E36AA0C5D8DDE2EC89DF5FE3F0B6A
SHA1:	8BD93B0B6E44FE46A80D1772E984BEDBB0FA789B
SHA-256:	E0A2A2EB28C33CE8C480A29537DDAF0CF1E4F0AD6773E6AF5032534ED52A5475
SHA-512:	4340EF1AED7603F7796045DA350F1B3F9A569601FFC4D86474D66D5FB58662655644CCC3E75051149EC3E09BDCE7A5844F05C5CE5FF482977D3E684B6C9EF41F
Malicious:	false
Preview:	2025/01/29-11:20:11.022 1700 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/29-11:20:11.022 1700 Recovering log #3.2025/01/29-11:20:11.022 1700 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.054220288846833
Encrypted:	false
SSDEEP:	6:iOuSv4q2PcNwi23oH+Tcwt8NIFUtMSvJZmw6SvDkwOcNwi23oH+Tcwt8+eLJ:7uTvLZYebpFUtMG/6654ZYebqJ
MD5:	CD6E36AA0C5D8DDE2EC89DF5FE3F0B6A
SHA1:	8BD93B0B6E44FE46A80D1772E984BEDBB0FA789B
SHA-256:	E0A2A2EB28C33CE8C480A29537DDAF0CF1E4F0AD6773E6AF5032534ED52A5475
SHA-512:	4340EF1AED7603F7796045DA350F1B3F9A569601FFC4D86474D66D5FB58662655644CCC3E75051149EC3E09BDCE7A5844F05C5CE5FF482977D3E684B6C9EF41F
Malicious:	false
Preview:	2025/01/29-11:20:11.022 1700 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/29-11:20:11.022 1700 Recovering log #3.2025/01/29-11:20:11.022 1700 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647768580026413
Encrypted:	false
SSDEEP:	384:aj9P0ncSQkQerZjlfP/KbtIgam6IThj773pLLRKToaAu:adxSe2RlfP/SjF7NRKcC
MD5:	4C9FC3DAF46DC357A46626473891372E
SHA1:	7621A51461B93CA7CADBA1A1C9C575FD88B3DF10
SHA-256:	1FD35274DFDCCCA5D7F1F392C41AFC48AC7C268A0B5099B029944DA9E745AA98
SHA-512:	467A575E418B4FF1EE03A3BFAB7C4EEA7F5EFB84B04681B63EEBA27644CB3F17FFABFCCCB18277C6BFC3E7BA8A71FEFB55A5A87512F6AA8AB90EAC2D6CCF9F02
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.226435079939313
Encrypted:	false
SSDEEP:	12:7uuvLZYeb8rcHEZrELFUtMA/6o54ZYeb8rcHEZrEZSJ:7XlYeb8nZrExg1oYeb8nZrEZe
MD5:	88B770580AED57B6C3AD4C8EE4959FA2
SHA1:	534DC5D978CFA3B818B1D7DDD79A8428D81CB434
SHA-256:	7148507662CB1907146DB676037CF9222DF7E6A2218D51FD01D83EB037A817E2
SHA-512:	C74BC3EC66DDC48BAC0CD96493687BB3594A0718D587A196F14999B72C7D904980DCAD5442FDC079DD05663BCAFD843C041C4E99540379CB79BDFB05934F3EB6
Malicious:	false
Preview:	2025/01/29-11:20:13.306 1700 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/29-11:20:13.307 1700 Recovering log #3.2025/01/29-11:20:13.307 1700 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.226435079939313
Encrypted:	false
SSDEEP:	12:7uuvLZYeb8rcHEZrELFUtMA/6o54ZYeb8rcHEZrEZSJ:7XlYeb8nZrExg1oYeb8nZrEZe
MD5:	88B770580AED57B6C3AD4C8EE4959FA2
SHA1:	534DC5D978CFA3B818B1D7DDD79A8428D81CB434
SHA-256:	7148507662CB1907146DB676037CF9222DF7E6A2218D51FD01D83EB037A817E2
SHA-512:	C74BC3EC66DDC48BAC0CD96493687BB3594A0718D587A196F14999B72C7D904980DCAD5442FDC079DD05663BCAFD843C041C4E99540379CB79BDFB05934F3EB6
Malicious:	false
Preview:	2025/01/29-11:20:13.306 1700 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/29-11:20:13.307 1700 Recovering log #3.2025/01/29-11:20:13.307 1700 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	5.585381325740759
Encrypted:	false
SSDEEP:	48:mZmWP1nbvQjXZBGV03Sx49RHHS2/48ylsFYyG:msmRvUn8eTQ8osFu
MD5:	2049EB66A8EC150AFB2EA9F9FDB3A402
SHA1:	3181695F69C66F0590D3B5B50868F756360AC449
SHA-256:	07BDAFF0C54F1DDAD1AB4BC7568F799EEF871A2A0D227B3F5FC516E4766B1A31
SHA-512:	E8310D6283552F5661A1E6D1589BB648A88F5730850AAD2AE6AE00B6929891B11BB0E1EC8E853D8B6628374908C36703EADBF8B01894C8ADD70A9B5A69121E08
Malicious:	false
Preview:	.3@.<................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1023}.!_https://ntp.msn.com..LastKnownPV..1738167617214.-_https://ntp.msn.com..LastVisuallyReadyMarker..1738167618361.._https://ntp.msn.com..MUID!.27F6FBCECCB8627D1201EE4DCD1063CA.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1738167617298,"schedule":[-1,-1,-1,-1,16,28,35],"scheduleFixed":[-1,-1,-1,-1,16,28,35],"simpleSchedule":[21,48,20,32,10,52,30]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1738167619342.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250128.179"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_ht

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.173562216934246
Encrypted:	false
SSDEEP:	6:iOuTLrSN+q2PcNwi23oH+Tcwt8a2jMGIFUtMTLSIN2WZmw6TLfVEVkwOcNwi23oL:7uLSN+vLZYeb8EFUtMy5W/6/KV54ZYek
MD5:	C318ABA2C2DC04A6A4C922388D98AF5E
SHA1:	236B44CBF84F4AB8D5E1CD9EEC43EDF6BBA3DDB0
SHA-256:	61BF4FFFD42A2AA67122AF686551F0152552803B884044193D63FE3FDDE9CC0D
SHA-512:	33ED053370FFCD8359D2EDBDD8B89F2AE3969DF3933C5CF6126BDA134A9D2BDAA9B9499BF1B53618402603F3C411F91918057267F0FFC6A1658F447850F8F5DF
Malicious:	false
Preview:	2025/01/29-11:20:09.873 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/29-11:20:09.876 15c Recovering log #3.2025/01/29-11:20:09.882 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.173562216934246
Encrypted:	false
SSDEEP:	6:iOuTLrSN+q2PcNwi23oH+Tcwt8a2jMGIFUtMTLSIN2WZmw6TLfVEVkwOcNwi23oL:7uLSN+vLZYeb8EFUtMy5W/6/KV54ZYek
MD5:	C318ABA2C2DC04A6A4C922388D98AF5E
SHA1:	236B44CBF84F4AB8D5E1CD9EEC43EDF6BBA3DDB0
SHA-256:	61BF4FFFD42A2AA67122AF686551F0152552803B884044193D63FE3FDDE9CC0D
SHA-512:	33ED053370FFCD8359D2EDBDD8B89F2AE3969DF3933C5CF6126BDA134A9D2BDAA9B9499BF1B53618402603F3C411F91918057267F0FFC6A1658F447850F8F5DF
Malicious:	false
Preview:	2025/01/29-11:20:09.873 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/29-11:20:09.876 15c Recovering log #3.2025/01/29-11:20:09.882 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d486a5d-f284-4a0a-b25c-e687270718da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\285a8ea4-9540-4257-a38e-0a25f5f75fca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\598b897c-5baf-474e-942c-1b6c4ed181da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.780970184422445
Encrypted:	false
SSDEEP:	192:tTunl5rcMOPGLysqTcQguU/CS47pUXcf0L/ZJVb:VunvxOeLZqTbguJlUXI0LhJVb
MD5:	AF254888B3D2F8E37887839044E47DF1
SHA1:	386D77527D2BA6EF8AC8C7A2CF59993B5612BE05
SHA-256:	7659DF482F665C7803D6619FDCCDB44A945E7FC7EF4DFDA810F0876F43C808C5
SHA-512:	14E9D7EA2B973640B08324C928A27CFA9F0EAF15DC2BD9D76A28AADF06673ED7C72D60FE4685EF717B836EFAF30D700FAA0CA55A357FAFE8D6C3344B8220EDC6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3772440236739525
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS2We:JkIEumQv8m1ccnvSTLDHlGFh5O/Bw1a
MD5:	0687E166B96A910EE304FCC13761C940
SHA1:	E0F00B0A49581E62AA9DFEB59B95A5DF43C2908E
SHA-256:	C18FFCB83CEF701F3E2862D14F1F6A569861BE26DB8B75A7F7053D8C3AA20472
SHA-512:	84856C4A88E5C4D1EBD027125C6A2A4BDD0EBA0A8A759E5B13B1CE6B918920DE0C053D72D24C33799B27D4D4B9335EC34B4057DE32BB59732452864613907534
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF30d20.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31de9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF32367.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b17e1f53-6e19-4544-86b4-bff565d6683a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bfa7ad1f-6db5-41bd-9cf5-8a23e43c8423.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13408
Entropy (8bit):	5.225148223672614
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNP9kemYs5t8JbV+FELQwG3VhPDYJ:st5PGKSu4BstO7tJXWabGgQwMc
MD5:	BE321172D3031C4CEA7A1CBE7E98CB3D
SHA1:	99B48601001CE1F4AE01DD13E1B5486282C3A9F7
SHA-256:	EAB3D028EA95ADD3A5B7E0066DEB8D0EB28AD86AAF8AD68D53647E8FAA56DC42
SHA-512:	ECA414A6041E0894543A44DCDBF4ACDAF92EBB475C843EDAD3A45091E8BBA9BECFF06F4387D0B42E80417E431CD6EBC2AF129F51B709CD01098AC715086BBD18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF34874.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13408
Entropy (8bit):	5.225148223672614
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNP9kemYs5t8JbV+FELQwG3VhPDYJ:st5PGKSu4BstO7tJXWabGgQwMc
MD5:	BE321172D3031C4CEA7A1CBE7E98CB3D
SHA1:	99B48601001CE1F4AE01DD13E1B5486282C3A9F7
SHA-256:	EAB3D028EA95ADD3A5B7E0066DEB8D0EB28AD86AAF8AD68D53647E8FAA56DC42
SHA-512:	ECA414A6041E0894543A44DCDBF4ACDAF92EBB475C843EDAD3A45091E8BBA9BECFF06F4387D0B42E80417E431CD6EBC2AF129F51B709CD01098AC715086BBD18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3930a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13408
Entropy (8bit):	5.225148223672614
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNP9kemYs5t8JbV+FELQwG3VhPDYJ:st5PGKSu4BstO7tJXWabGgQwMc
MD5:	BE321172D3031C4CEA7A1CBE7E98CB3D
SHA1:	99B48601001CE1F4AE01DD13E1B5486282C3A9F7
SHA-256:	EAB3D028EA95ADD3A5B7E0066DEB8D0EB28AD86AAF8AD68D53647E8FAA56DC42
SHA-512:	ECA414A6041E0894543A44DCDBF4ACDAF92EBB475C843EDAD3A45091E8BBA9BECFF06F4387D0B42E80417E431CD6EBC2AF129F51B709CD01098AC715086BBD18
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564270737177121
Encrypted:	false
SSDEEP:	768:bjDtM3WPD/fSH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLVu7j0rwnZP/LqKp5tuX:bjDtM3WPD/fSHu1jaBLV2jtnZP/uUts
MD5:	F89B75A20345024D3335D8FE3953741D
SHA1:	8B1E360DD79E12846E06E23346E1611B6DBD5E91
SHA-256:	51939FC4E72DCE143B453ACB02D18AD93E16D6509BDC62CE4242A487AC17A1DE
SHA-512:	D8F0298849B1BC90C27D56BC8D86791108E87ECC5175D18629592752CBC098A217EDEC5EA924B792711843DF7AE7E115E8D9BF164A1D5EFAC530AD9A96811624
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382641209603749","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382641209603749","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF34a68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564270737177121
Encrypted:	false
SSDEEP:	768:bjDtM3WPD/fSH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsLVu7j0rwnZP/LqKp5tuX:bjDtM3WPD/fSHu1jaBLV2jtnZP/uUts
MD5:	F89B75A20345024D3335D8FE3953741D
SHA1:	8B1E360DD79E12846E06E23346E1611B6DBD5E91
SHA-256:	51939FC4E72DCE143B453ACB02D18AD93E16D6509BDC62CE4242A487AC17A1DE
SHA-512:	D8F0298849B1BC90C27D56BC8D86791108E87ECC5175D18629592752CBC098A217EDEC5EA924B792711843DF7AE7E115E8D9BF164A1D5EFAC530AD9A96811624
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382641209603749","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382641209603749","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.81439223020162
Encrypted:	false
SSDEEP:	24:F2xc5NmTcncmoDCRORpllg2hE/fRHDldCRORpllg2hYLi5FCRORpllg2hEaRHDNB:F2em8Mrd6/fB1rdOixrd6aBTrdU5Bo
MD5:	4C57533F0CDF67D980FE486E75CE7C62
SHA1:	DB6F35B7CB6891C2039F88F1835B59A3A40B584E
SHA-256:	0D08F8617CF532DBA657596A2D32B52B09411CC650B9E2A9E5B1FB1F00E5B82B
SHA-512:	E0542168657FEF2259F4E48FA07DE7195F9391C705DE6B67A17F738E92E1BB8823AE0ADC88B4E8BDB5A3D381CD4262D4B98976FBCA06C9CA99EB8552CA4A4A41
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2).I.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.155498233311731
Encrypted:	false
SSDEEP:	6:iOuKq1cNwi23oH+TcwtE/a252KLl8wIq2PcNwi23oH+TcwtE/a2ZIFUv:7uKcZYeb8xL6hvLZYeb8J2FUv
MD5:	16F554708E4B189568128256910CFBF6
SHA1:	5AAE43C82B11CEE1F25243EA9E0C7BC552867F51
SHA-256:	8E7549E82E3786DCAD66DFA0CF58D55ECFC3CBB10BB3A6647C2AEC207F31ADC7
SHA-512:	6F45E674FC4F0F163E6A4016BD91E30930FC5F70E56DC46F450BA0EF8F0EE12B03D214FB81B5E1A30C38757AF4E1C08AB3EEEE0A11B09C8E4980023D30DFDE74
Malicious:	false
Preview:	2025/01/29-11:20:18.341 8d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/01/29-11:20:18.371 8d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116360
Entropy (8bit):	5.574835493123756
Encrypted:	false
SSDEEP:	1536:We906CxPXfOZa1PEYeIlL/NvKAd19Cjf3PONUFXr2DWGtZ1S8ZBBGQQuujGGu0ay:d9LCxPXfOZa1P5eIlL/tK819L469Mt
MD5:	AA562CCF49DC61F8BE565E9CE47697E8
SHA1:	C6863AD4B01E0258712F61CBE77ED47060DC51E6
SHA-256:	4FB1EABAE8A627E0517435A3BBFA053C247D107FF7C0AAD3335E99B77AA536DE
SHA-512:	19E78E7C0384AC3CFA4F6E1814CF949CA502F63938AE674E477870377F67FFD499476E0FE56C623D7002595C5EFE89E10436F04EBE82538497BDEFE6A2A952AE
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	191593
Entropy (8bit):	6.391374953349577
Encrypted:	false
SSDEEP:	3072:13wk5LMyve94w81gR9jZL/1H4XaZv1fwhcWJUgWM4V2fb7hh:/k4wEq9dL/d4KZ1ccoUgVC07hh
MD5:	B207C882FC6C4585DFD707938DB3B91F
SHA1:	C51B52E848CCB4C845CAB7D85600A2BA704ACD7A
SHA-256:	55EB8BF86669D801725A280E283F1CD62CD45B9402BB4FE9632C3B5E8DA4DA41
SHA-512:	0D6B59FC48E5FA59B25D1B366D141BD2F891018428DC8F4232D5554A2FFE705B455706BF6FBD61D0487AFDB9A50F87CDE9B6DAEB7EC68567B2A72BBFF2A8B5F2
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.Y7....exports...RcN..m....module....Rc.b'.....define....Rb6fM0....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q.......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....i...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:99juAyXl/l4/l9/lxEstllg/lzyvdZ:KAKoOseevv
MD5:	9B9CC2C5CF9AC4076AEE3F41BBD3B59A
SHA1:	52BBD1815B9659E491F177CD38685A4988920BD8
SHA-256:	34EDCBE6023D087B34A6C3502D644230FEB7BA6D754E63ACFEDC3F8ED064D436
SHA-512:	B6DBD660B31A868958D96CE4166EB2756815D0D5B23DE1EF971CA58E44E8995CF9F4DDC16D0CB9BC547927F49EB89539276F450063EA2F3511145F3466BD3F61
Malicious:	false
Preview:	@....X.1oy retne.........................X....,................L...p./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:99juAyXl/l4/l9/lxEstllg/lzyvdZ:KAKoOseevv
MD5:	9B9CC2C5CF9AC4076AEE3F41BBD3B59A
SHA1:	52BBD1815B9659E491F177CD38685A4988920BD8
SHA-256:	34EDCBE6023D087B34A6C3502D644230FEB7BA6D754E63ACFEDC3F8ED064D436
SHA-512:	B6DBD660B31A868958D96CE4166EB2756815D0D5B23DE1EF971CA58E44E8995CF9F4DDC16D0CB9BC547927F49EB89539276F450063EA2F3511145F3466BD3F61
Malicious:	false
Preview:	@....X.1oy retne.........................X....,................L...p./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF36b6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:99juAyXl/l4/l9/lxEstllg/lzyvdZ:KAKoOseevv
MD5:	9B9CC2C5CF9AC4076AEE3F41BBD3B59A
SHA1:	52BBD1815B9659E491F177CD38685A4988920BD8
SHA-256:	34EDCBE6023D087B34A6C3502D644230FEB7BA6D754E63ACFEDC3F8ED064D436
SHA-512:	B6DBD660B31A868958D96CE4166EB2756815D0D5B23DE1EF971CA58E44E8995CF9F4DDC16D0CB9BC547927F49EB89539276F450063EA2F3511145F3466BD3F61
Malicious:	false
Preview:	@....X.1oy retne.........................X....,................L...p./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	3.40013480246402
Encrypted:	false
SSDEEP:	192:p48ldmsklw//tn0NIRVg29Xp+rgisDELl9iSrO3tJ0/gts8IKN:pbldSl4q29Xp+UsLl9iSrEtm/gt5
MD5:	10E36D52B626A50B76FC1D5659DDCCAD
SHA1:	319F948BB8DF9DCA245665D03C8D77C9ED2D6F1E
SHA-256:	2AC1874747B500BBF1FDADF74E317C393C31B30AC99C46FB1ECA90BE9B250887
SHA-512:	F23B3A2CA9E8CE59139E3C70F426CED42ADB36C6450614BB8B52CC92E39AFA58BE93703CC6603F6DD1456E4BEBE7A23DF932613A527E2ACAD69FD0FF49FCC47B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............i ..b................next-map-id.1.Cnamespace-f2274437_6354_40b7_8a17_868cb6a497a3-https://ntp.msn.com/.0.MQ..................map-0-shd_sweeper.8{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.c.x.t.s.c.-.t.1.,.p.r.g.-.r.e.l.a.t.e.d.q.r.y.,.p.r.g.-.r.l.t.q.r.y.c.l.k.,.p.r.g.-.s.b.c.a.t.,.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.c.p.r.g.-.v.i.e.w.s.-.c.c.r.e.s.p.i.p.,.p.r.g.-.v.i.e.w.s.-.r.e.s.p.i.p.,.p.n.p.w.x.e.x.p.r.e.g.3.6.0.,.b.i.n.g._.v.2._.s.c.o.p.e.-.c.,.d.q.-.l.o.c.k.-.w.p.o.-.t.2.,.1.s.-.a.c.t.d.a.i.l.y.q.u.i.z.,.1.s.-.b.w.o.s.c.a.c.h.e.,.1.s.-.c.h.-.d.q.z.,.1.s.-.p.1.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.1.-.d.a.i.l.y.q.u.i.z.t.3.,.1.s.-.p.2.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.2.-.d.a.i.l.y.q.u.i.z.t.3.,.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.112223891465688
Encrypted:	false
SSDEEP:	6:iOuwVUD+q2PcNwi23oH+TcwtrQMxIFUtMt32WZmw6+KVkwOcNwi23oH+TcwtrQMT:7uwK+vLZYebCFUtMF2W/6JV54ZYebtJ
MD5:	BE1AD55D911ABF07058308606BDFCFF9
SHA1:	B9D691E12084D68EEE949372311A4FDCA440AF43
SHA-256:	9D19CA4615D6305C5381BAA68DE7CFCADD00D0C677D0BF3E47256F9BCD295145
SHA-512:	E604A44FD46A185DD00BF321AA3B2AC6DF438CA28E0074012C1C996EB6A137A8C0945BF9EF115D7833F08EC4DA0D3E237DBA5F0F975EEB1C93750C9E21713093
Malicious:	false
Preview:	2025/01/29-11:20:10.962 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/29-11:20:10.979 15c Recovering log #3.2025/01/29-11:20:10.982 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.112223891465688
Encrypted:	false
SSDEEP:	6:iOuwVUD+q2PcNwi23oH+TcwtrQMxIFUtMt32WZmw6+KVkwOcNwi23oH+TcwtrQMT:7uwK+vLZYebCFUtMF2W/6JV54ZYebtJ
MD5:	BE1AD55D911ABF07058308606BDFCFF9
SHA1:	B9D691E12084D68EEE949372311A4FDCA440AF43
SHA-256:	9D19CA4615D6305C5381BAA68DE7CFCADD00D0C677D0BF3E47256F9BCD295145
SHA-512:	E604A44FD46A185DD00BF321AA3B2AC6DF438CA28E0074012C1C996EB6A137A8C0945BF9EF115D7833F08EC4DA0D3E237DBA5F0F975EEB1C93750C9E21713093
Malicious:	false
Preview:	2025/01/29-11:20:10.962 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/29-11:20:10.979 15c Recovering log #3.2025/01/29-11:20:10.982 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13382641212086953

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.831388747541816
Encrypted:	false
SSDEEP:	24:3NlMZ8WCpsAF4unx2ftLp3X2amEtG1ChqYphNGAQKkOAM4:3N08pzFwLp2FEkCh/8HOp
MD5:	DB14F7C6A69A1E61A0A2202C682C4154
SHA1:	BBE30587BC09197AF49B7A658EFDACCD6C767849
SHA-256:	892514BC25B740919E56720F491CB3994A8D4CA2AC6C1C82586DE8BBD8DD17EA
SHA-512:	83022B90DF5A825DB819C7DA9094972236856756E6FB6AD82D1C0CC4EC44B8C78583F4B8C4BA1FE5553FB20C53F3EF5C37A92BD690118003F52C88EB7A2AB54F
Malicious:	false
Preview:	SNSS........$NM............$NM......".$NM............$NM........$NM........$NM........$NM....!...$NM................................$NM.$NM1..,....$NM$...f2274437_6354_40b7_8a17_868cb6a497a3....$NM........$NM................$NM....$NM........................$NM....................5..0....$NM&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}......$NM........$NM...........................$NM............$NM........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x............,.......,.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.159174980281706
Encrypted:	false
SSDEEP:	6:iOuTLfIX9+q2PcNwi23oH+Tcwt7Uh2ghZIFUtMTLfIXJZmw6TLfNVkwOcNwi23oz:7u/S4vLZYebIhHh2FUtM/SJ/6/z54ZYz
MD5:	D057825EB619BBDA8CB82853EBED1B40
SHA1:	0055455E53B069FAF12C1B7CD8F1ACC004BBB246
SHA-256:	A00DB5DA12D3FE3476A8586FBD6B69250EA16075B68539E080A49DBC6667A314
SHA-512:	9646EFB11DB0A356511161EA5925C4BB96FC74DD05BD14B131E7BCDC1F369BE0FAE9FA7C34BDB36706CB4F9B30E299D2C50573A5EA0E87EE436B14CD625A5BBA
Malicious:	false
Preview:	2025/01/29-11:20:09.664 fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/29-11:20:09.664 fe8 Recovering log #3.2025/01/29-11:20:09.665 fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.159174980281706
Encrypted:	false
SSDEEP:	6:iOuTLfIX9+q2PcNwi23oH+Tcwt7Uh2ghZIFUtMTLfIXJZmw6TLfNVkwOcNwi23oz:7u/S4vLZYebIhHh2FUtM/SJ/6/z54ZYz
MD5:	D057825EB619BBDA8CB82853EBED1B40
SHA1:	0055455E53B069FAF12C1B7CD8F1ACC004BBB246
SHA-256:	A00DB5DA12D3FE3476A8586FBD6B69250EA16075B68539E080A49DBC6667A314
SHA-512:	9646EFB11DB0A356511161EA5925C4BB96FC74DD05BD14B131E7BCDC1F369BE0FAE9FA7C34BDB36706CB4F9B30E299D2C50573A5EA0E87EE436B14CD625A5BBA
Malicious:	false
Preview:	2025/01/29-11:20:09.664 fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/29-11:20:09.664 fe8 Recovering log #3.2025/01/29-11:20:09.665 fe8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.230593634162131
Encrypted:	false
SSDEEP:	12:7udWvLZYebvqBQFUtMy/6nT54ZYebvqBvJ:7FlYebvZgkFoYebvk
MD5:	B76EFFA97FB3FA0745D77C16BEEDB58E
SHA1:	757597D1D33B84B891BC2FFE140985652CFAA21C
SHA-256:	F688B1A8FD8C6219ADB4AA2E2177C03D8AA65322BD80276D63739623641B5FBE
SHA-512:	0CBD819DAC1E6C93084D89C08B401F522343C5E42DF7F45429B8E95E56500AE503B7D003CED288029724FBFA04AEF6BE540F7A92B41BDA1CF31D72D597372250
Malicious:	false
Preview:	2025/01/29-11:20:10.986 1064 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/29-11:20:10.987 1064 Recovering log #3.2025/01/29-11:20:10.991 1064 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.230593634162131
Encrypted:	false
SSDEEP:	12:7udWvLZYebvqBQFUtMy/6nT54ZYebvqBvJ:7FlYebvZgkFoYebvk
MD5:	B76EFFA97FB3FA0745D77C16BEEDB58E
SHA1:	757597D1D33B84B891BC2FFE140985652CFAA21C
SHA-256:	F688B1A8FD8C6219ADB4AA2E2177C03D8AA65322BD80276D63739623641B5FBE
SHA-512:	0CBD819DAC1E6C93084D89C08B401F522343C5E42DF7F45429B8E95E56500AE503B7D003CED288029724FBFA04AEF6BE540F7A92B41BDA1CF31D72D597372250
Malicious:	false
Preview:	2025/01/29-11:20:10.986 1064 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/29-11:20:10.987 1064 Recovering log #3.2025/01/29-11:20:10.991 1064 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\07c35962-c6a7-42a2-9181-df193e5800ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4afc1c38-0088-4ed6-96e2-7055ab6ae750.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF31de9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF32367.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cde28070-0976-4462-95b8-e5e9fabb4c4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ea895d13-7941-41a2-95fd-e50d1b8509de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.221929143041405
Encrypted:	false
SSDEEP:	12:7uH+vLZYebvqBZFUtMxW/64V54ZYebvqBaJ:7plYebvyga8oYebvL
MD5:	DF0735784A7CFDEA21EE52FDAAA1AB0C
SHA1:	BFED49D2A6DC2A945126718E33B7BE84899A0164
SHA-256:	387A2C5AF03940231959839DCECFFDEBC120615390F86129BBEB362DAC3502B5
SHA-512:	B9FAEDE67947BB2CACA9ACAAB90EFCE9D84ECB35B41EFF49704DF1D4F7A87B0E87908A9AB372A558EF451F386BF159C9C7D318FB6E51C0868C45E7125794B14E
Malicious:	false
Preview:	2025/01/29-11:20:27.043 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/29-11:20:27.044 15c Recovering log #3.2025/01/29-11:20:27.048 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.221929143041405
Encrypted:	false
SSDEEP:	12:7uH+vLZYebvqBZFUtMxW/64V54ZYebvqBaJ:7plYebvyga8oYebvL
MD5:	DF0735784A7CFDEA21EE52FDAAA1AB0C
SHA1:	BFED49D2A6DC2A945126718E33B7BE84899A0164
SHA-256:	387A2C5AF03940231959839DCECFFDEBC120615390F86129BBEB362DAC3502B5
SHA-512:	B9FAEDE67947BB2CACA9ACAAB90EFCE9D84ECB35B41EFF49704DF1D4F7A87B0E87908A9AB372A558EF451F386BF159C9C7D318FB6E51C0868C45E7125794B14E
Malicious:	false
Preview:	2025/01/29-11:20:27.043 15c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/29-11:20:27.044 15c Recovering log #3.2025/01/29-11:20:27.048 15c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.19924289777078
Encrypted:	false
SSDEEP:	6:iOuTLcq2PcNwi23oH+TcwtpIFUtMTLNZmw6TLbTkwOcNwi23oH+Tcwta/WLJ:7u8vLZYebmFUtMt/67T54ZYebaUJ
MD5:	8E8942A7733B71BB3A4DC444D6789DA7
SHA1:	6ED56BDC2A028190D637608CA4CCAE2A88527B75
SHA-256:	1378A4316E23C4D18D9A639B629B1328728273E0BE1427F058943A1A9F3A3EC4
SHA-512:	BB5D44BD5E000F088C4417CE5AE9D9770CC1D183594547B74FFF43B11606FFE29BB0A5FC4927B900B12755074BFB4081A4C68A7708B10E7588E2947C37DDC70F
Malicious:	false
Preview:	2025/01/29-11:20:09.619 13f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/29-11:20:09.619 13f4 Recovering log #3.2025/01/29-11:20:09.620 13f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.19924289777078
Encrypted:	false
SSDEEP:	6:iOuTLcq2PcNwi23oH+TcwtpIFUtMTLNZmw6TLbTkwOcNwi23oH+Tcwta/WLJ:7u8vLZYebmFUtMt/67T54ZYebaUJ
MD5:	8E8942A7733B71BB3A4DC444D6789DA7
SHA1:	6ED56BDC2A028190D637608CA4CCAE2A88527B75
SHA-256:	1378A4316E23C4D18D9A639B629B1328728273E0BE1427F058943A1A9F3A3EC4
SHA-512:	BB5D44BD5E000F088C4417CE5AE9D9770CC1D183594547B74FFF43B11606FFE29BB0A5FC4927B900B12755074BFB4081A4C68A7708B10E7588E2947C37DDC70F
Malicious:	false
Preview:	2025/01/29-11:20:09.619 13f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/29-11:20:09.619 13f4 Recovering log #3.2025/01/29-11:20:09.620 13f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652430223787965
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMJSAELyKOMq+8HKkjucswRv8p3nVumu:K0q+n0JJ9ELyKOMq+8HKkjuczRv89S
MD5:	6110075305294E35AF2A0C724CFCD3A0
SHA1:	8F793D1FB960ABE486C088E1ED55540A16A5D8A0
SHA-256:	EB348CA055BAC941DE62C6EA7A0BEDE4737F3EEAE5F186DDCEC752F0F4DD3822
SHA-512:	DCD9CFFAA9C1B32DBAF10070202EF328070BF6ED2A7BC37ECD6A68A9ADAF927291B103019E18B8E807F02B727248C46A60DAA34D6449EC080DBB853A5EE61F79
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46639042193516506
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0NYb:v7doKsKuKZKlZNmu46yjx0C
MD5:	BFE77D0DA03A52DFD21D9B53D3D8A01A
SHA1:	A324B33CFB37351515C94C14EAB941B293AA67DA
SHA-256:	2CC1FCB327D8A5671A2BA192F0785CC511E06CB9A9AA7FACE41ECCD6FCEC2709
SHA-512:	BD84D6B76122FC61C07D511445269748934AB27564834C64EDC8CAB231B996BF7924ED92975F8A03C94628D522048D3B5E8344ABD8CE9BF3B4DACAD8D3823125
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e643f20b-cc41-46b0-8294-3b3ec2aa336e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14166
Entropy (8bit):	5.287674468893086
Encrypted:	false
SSDEEP:	192:st5J99QTryDigabatSuypBs4wO7yaNPFTvkemYs5t8JbV+FELQwGq+iPDYJ:st5PGKSu4BstO7tJFTpWabGgQw9+b
MD5:	1997C5799A822EABCFEA14DE84934FE5
SHA1:	753F490800EAB7C69083E7EC2850C0545D40C606
SHA-256:	12AC818E4503908B4E8E30C6524B0088FA14C657FBDB1CF4D89E7EAC21054A38
SHA-512:	CEFFF6435ABB82FA1D382E9F9961E6D6A32A719B8935F25ED0688F5D8CD60FE4AEBCE71AC010239F3D132E04CAE4A06787F29B7AD08B5CC0806FA9A41E028570
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382641210570695","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10927051822625933
Encrypted:	false
SSDEEP:	12:04oOS4oZLpEjVl/PnnnnnnnnnnnnnvoQrEo8VF4D:0pOSpfoPnnnnnnnnnnnnnvBjpD
MD5:	E22FDA9460A53A4BB1466CC160103E13
SHA1:	724A3561CB4A2CA99CB4213D38D20C7F65D835C8
SHA-256:	B4140F639E1802508044F7D26E935392CEA0FFA7BC751153CD68707CD7A22F23
SHA-512:	99DC345447A45C30BD70670B253E829781110AF73DFC1B1254F2B77EF5395418AC685015D67B3846813146B4DBDB6FF2FF38096243A690BE309D100755A04919
Malicious:	false
Preview:	..-.............U.........j.A..3.-.....k....l....-.............U.........j.A..3.-.....k....l..........Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9766108339435162
Encrypted:	false
SSDEEP:	384:os9Lx+TYZp2LpSFGuyZYkCB8q888tdc+86wyIy5HyBynIy6xyF+:fqMp
MD5:	A341007FB7815CA1B666C2C26F4E96B7
SHA1:	20AE4483DBA704E23CD1A547B1121EC1D4F1B918
SHA-256:	B90FE68A00197ADEBAE093ED90E9E48B8EA64451A03180CD1D71A7359479D3BD
SHA-512:	75B8C76C2F95A34A0F219863EEC6F4A74573DEC46DED6E5321EBFAFCBC5399DB2998B203C59E148BAED4423A36DD5B5899274A9480E640E91B93660260EA62B3
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.024272216754861
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuiillhDlUAlNZ/Ze9sedhOd:llc8BOuuuuuuuuuubllh5HNZMO8g
MD5:	028FE54FE9740C42DCD1B596B79D938A
SHA1:	6D41A2F682113141C4E35602351AB4B3A0357942
SHA-256:	6D0D14B809D315805BBAC471F1459766AE34E0A0D68EE49C7CBD08566BDF8711
SHA-512:	8215B8297EF2E373631E32545130FCA19782F47CD5713C1118230481CA35753FA1B2C55A3A80AC2FA1AAF5013FC31A1FC52D5EC08100D1F1D45813A3A300161D
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................_.i;...............#38_h.......6.Z..W.F.......@.......@..........V.e................V.e.................m.`0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.247226682223996
Encrypted:	false
SSDEEP:	6:iOutJFB+q2PcNwi23oH+TcwtfrK+IFUtMtdZmw6t0BVkwOcNwi23oH+TcwtfrUed:7u6vLZYeb23FUtML/6SP54ZYeb3J
MD5:	8B4938B9D1680C7F224A8B60C6516135
SHA1:	057EE96EDEF80E03A9E5F044B1CEE9C0D77C6F5C
SHA-256:	EA0238F239E33FA36EE4F534682CF76BD136C1F0C6AFE463477B027C92F1A84D
SHA-512:	061C5C36D95B75179F27ED267DC19F247734AFD57BB17BF0BD6D7836B97E9817407B05E8C8CDE4EF0D413F822392D9AB5460C5A2152F9C64FD87F82009D61249
Malicious:	false
Preview:	2025/01/29-11:20:10.659 848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/29-11:20:10.664 848 Recovering log #3.2025/01/29-11:20:10.665 848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.247226682223996
Encrypted:	false
SSDEEP:	6:iOutJFB+q2PcNwi23oH+TcwtfrK+IFUtMtdZmw6t0BVkwOcNwi23oH+TcwtfrUed:7u6vLZYeb23FUtML/6SP54ZYeb3J
MD5:	8B4938B9D1680C7F224A8B60C6516135
SHA1:	057EE96EDEF80E03A9E5F044B1CEE9C0D77C6F5C
SHA-256:	EA0238F239E33FA36EE4F534682CF76BD136C1F0C6AFE463477B027C92F1A84D
SHA-512:	061C5C36D95B75179F27ED267DC19F247734AFD57BB17BF0BD6D7836B97E9817407B05E8C8CDE4EF0D413F822392D9AB5460C5A2152F9C64FD87F82009D61249
Malicious:	false
Preview:	2025/01/29-11:20:10.659 848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/29-11:20:10.664 848 Recovering log #3.2025/01/29-11:20:10.665 848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.226060715200398
Encrypted:	false
SSDEEP:	6:iOutRn7+q2PcNwi23oH+TcwtfrzAdIFUtMtRnrZmw6tRn7VkwOcNwi23oH+TcwtS:7uvivLZYeb9FUtMvr/6vh54ZYeb2J
MD5:	DD01645353C29A5296FB91B67E676FB5
SHA1:	C6F3609EAAB7899E283DD848BFCAEC181DD150FA
SHA-256:	7C3A39878B86E948FEE0AA4C274C45CD8953ED9D5FC2643699297928810AE9CA
SHA-512:	618B7CB13D25E11D1D7D19C9F9447CA1ADD3723E1033339D3E81B0D7CA057B862608989AE4F8C4A2B87EE32893157154C47A642B064E9901A143903213C4E181
Malicious:	false
Preview:	2025/01/29-11:20:10.633 848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/29-11:20:10.633 848 Recovering log #3.2025/01/29-11:20:10.633 848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.226060715200398
Encrypted:	false
SSDEEP:	6:iOutRn7+q2PcNwi23oH+TcwtfrzAdIFUtMtRnrZmw6tRn7VkwOcNwi23oH+TcwtS:7uvivLZYeb9FUtMvr/6vh54ZYeb2J
MD5:	DD01645353C29A5296FB91B67E676FB5
SHA1:	C6F3609EAAB7899E283DD848BFCAEC181DD150FA
SHA-256:	7C3A39878B86E948FEE0AA4C274C45CD8953ED9D5FC2643699297928810AE9CA
SHA-512:	618B7CB13D25E11D1D7D19C9F9447CA1ADD3723E1033339D3E81B0D7CA057B862608989AE4F8C4A2B87EE32893157154C47A642B064E9901A143903213C4E181
Malicious:	false
Preview:	2025/01/29-11:20:10.633 848 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/29-11:20:10.633 848 Recovering log #3.2025/01/29-11:20:10.633 848 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f747.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31e18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014788110415494
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAcldnU0yn:YWLSGTt1o9LuLgfGBPAzkVj/T8lNU0y
MD5:	50DA75A99A5EA1D5995DBEE75BEF9C3D
SHA1:	A32BF44ADDD1B79B55282805E0AAA5ED3CDACBCA
SHA-256:	BD31ECAE2B930E0A07C53E30CB767AEE2F8E7F28E55E13C99D5221B1B044494E
SHA-512:	D26295C037C31C26DD9C20FB5DBDBDC390431584398FA84B076EAEC5B1019C22FED68D880520C6E52DE3D49CD52731D510DEFA5C1333B8E0E2A327622298C708
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1738268414200058}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ada437bf-8ef3-4569-bbe6-2db887d61221.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45855
Entropy (8bit):	6.087297988375752
Encrypted:	false
SSDEEP:	768:/MkbJ6eg6KzhXRLrDabKKKGf4IBhoX47vzpbdO2WSCioN7DRo+yM/42cRaLMos74:/Mk16zRRvDap9bRWSFoN7VLyMV/Yoss
MD5:	BFFDF553C17D42022773DAC342EA19D8
SHA1:	706C23BBABC8F09220BFF7215684C2E2C5488C83
SHA-256:	611168D59BB9D91B026F9AB33AF092DF784369832AA4A5088CA3E2EBCFCF3E71
SHA-512:	2F8661C891AB8994A466F9C452711D0C1909E555A94B96908227C59F4DF98E036FA6A5576BB027BB65DAB984ADD521DC03BC7C6D060CADD89E39B57191957CFB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"7d37b162-63e6-4764-8271-683aace8e8eb"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1738167615"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8a63aa2-3610-44ae-9414-96399f84e999.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089521842170098
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kOTKKGf4S4tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynwt5b7VLyMV/YoskFoz
MD5:	5DB682EC9CD40507A20A1F407692B842
SHA1:	5189F949276353407E9232798DFCAE61564A2051
SHA-256:	150DB91F7BCDBEA960E7B18D0D9278BD1EA1A28806286A9A97F6CB67FAB9D986
SHA-512:	ADC5CA8801D64BC1F64A7D26536C5A0CBC9ACA436823A606B1834978612B4F28B566B43B398CD2331D62B9B0CC20A364E6EE6053A5C837E8C323F05F1747C96D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.856265650105568
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxIxl9Il8uF48Ra0LTl5O3eND1VaY9Ud1rc:mVYDjRa0LvO3eDVaa
MD5:	87A632A7575D70FE02D1EAED6A11BF62
SHA1:	C5964453E11476FF286FE8A420C02F55BCD72378
SHA-256:	3456885CFAC3A8AE8BE597700069C131E2890C756917B8A11BA3F3EA9AF90581
SHA-512:	DECBEAC36BC7550CD918607E8BD06C9B18C927AC58593125A2157B578C61AC1FB71042C3719169ADDC5DCB6011DE14F7C9C5A152393A345050BE478369D50BF6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.v.v.D.n.J.y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.u.g.W.D.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.996090989969392
Encrypted:	false
SSDEEP:	96:nYqe91Q0Ob4CBSFTV9973ZuTyHjEcUITrWbtT:n5EDa4fVX73ZIyHjEcjcT
MD5:	764B54EC35FEE4CFBE7B79F5F2F3F672
SHA1:	940FAE59879C86700F00CCEC97C8354BB8F8FC5E
SHA-256:	EF1862F39EAEA07F16EC00C1213508391EC586C807DC44FA1CE7D4BEB726573C
SHA-512:	9B2752383B2C4C9DE2A86097D9AA0FA61F55DD8E422059800888C33C8E8254B99F06B2370B6E85072D7237730F16EC2F4606082E7B19F1D3E7C1DE62542CED7B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:."./.P.4.e.9.W.l.y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.u.g.W.D.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9002804256196986
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xPxl9Il8uHITxyaViqlzGm11XutdMWyC6td/vc:axYBqyelzGm11eXgCF
MD5:	6756E953A6B69924B14F3A7C8DCD65DF
SHA1:	8F696A2EF42BBF2B7949E8A4DBA770B596703AA4
SHA-256:	6B6001BFEAC14A8AF6727C6626B5EFFD22E848855731BE7FF857C1148FC33E7E
SHA-512:	DCF3C2EDECCB7376519603921EFD19E11CB6CC5D4C01278E79E32A913DFA98F190700E27FD30FB7C04AF27A34E87B7AFC0C256EB09180E06C6B1191BF7083D0A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".j.t.y.R.J.T.u.R.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.a.u.g.W.D.d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3973009230781015
Encrypted:	false
SSDEEP:	96:6NnCuHCgNnCX4bCSNnC2LWL89C2L/NnCldgECQNnCJiWi3CJikNnC/oDCQXNnCUv:6NLNzNNyq7NGHNPp/kNfdN1NNz
MD5:	F1E563685F77B8520893E3D76F658F96
SHA1:	49F6681D2F98E1B9CBA2C86E0D218A7202A9DC7A
SHA-256:	5B6CDB5519E97135C6D3C4006B3CC521FAA3976C42B48FDC134E4A1CC712C106
SHA-512:	4BFB408DAE71D69BD3021C7E8EBB3E19271BAAD7949FCF0CE7C618ABEF830533BB33F43E51BF1481A236130CBC652E94F1DD384E81E3C9E9B2C1F6F36F3528FA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/95D9DE7DCD419848B0841373011B0B7D",.. "id": "95D9DE7DCD419848B0841373011B0B7D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/95D9DE7DCD419848B0841373011B0B7D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/165FF114E80236FBBC104733D8A92DE7",.. "id": "165FF114E80236FBBC104733D8A92DE7",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/165FF114E80236FBBC104733D8A92DE7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\36469\Avoiding.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.382532038525693
Encrypted:	false
SSDEEP:	48:SfNaoCVm8TECVYfNaoC/43C/CfNaoChkIkaChkCfNaoCRk00UrU0U8Cp:6NnCVm8TECVkNnC0CyNnChBpCh/NnCRW
MD5:	54BAF4C1A8292C1E64383AD1686206CE
SHA1:	68A178B1F096F679843F6FDCC8B7A8E35D3D7CDC
SHA-256:	4C11AA4166062E66F3C3E7625B48EC91500E97D17BFB3AA792A7A2EC85DC61F4
SHA-512:	5F7E3B36FA2F5397A6F6EBA25FA3C46B04FE28C40BBA83C8CDF0C0EECBD00B35C7085A74DF5CCC6F8138929B25BE803A5C1802F85AEC37DDB997D76C61900A42
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/6FBEED4FE0F726E73C9F42FED31BC2D6",.. "id": "6FBEED4FE0F726E73C9F42FED31BC2D6",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/6FBEED4FE0F726E73C9F42FED31BC2D6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/312C25B98230DE75627C2915AD04C850",.. "id": "312C25B98230DE75627C2915AD04C850",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/312C25B98230DE75627C2915AD04C850"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\195ba3de-51b7-49dd-a0ba-674d9eb4904c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\1ab32018-f4db-4e37-a840-bdc5f725c58b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\36469\L

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	423104
Entropy (8bit):	7.9995570032580146
Encrypted:	true
SSDEEP:	12288:o9Va32etCVzFUAa0mDMdgWiKuoB4LL17vN5As061:o9HPmP0j/74Lxhb0o
MD5:	5CF075139DBEA15B8D43466AD0F462E4
SHA1:	2C18854036F47DADB15721E7925A92F3157D911D
SHA-256:	93E87C6385829E6878EFE848522582ACCF79EF306011E4C7FF4D5B414AADBAC7
SHA-512:	A959C6FEDB08B6064D3CBF6B8AD54B498405A52677D625A12A89B92268FB051DF15CD739D6EBA2E4436731EA0A25626E4D101D76472AE90AB7CA72A2D5E69FF3
Malicious:	false
Preview:	.R....^.Vi...n,.....H....x.O....]..\.J..._......87......]n...T..?I.....$uC.....8..........7v..2J@.1Gd...x..J......+L.....8......y3.QG..,\|.....o..y.D..<.....x...V.\78..8..Y...M..i..Q.p}U6I.(...L).@.A\mv.S.....h..6.....R...B.Ra...(.@S....e`......$.U.]......i.F...nS.t.U..}...)2...k...._..q.W.....t....S..........d},.........0<J.l?......qZ....'?E9....!..]4:@.pL.\..QOL.X<>.P..~......H..e..1..sF.^E-..eDQ..]wN......5.....'...g.9j..2Oq..J.Y\...\|...K.%.j.<..2T..>.~.i[.l..&F.....{.<D.o.G....I.sJ...$V.h"C\|)...?.Z.W...6V..\.2..Ts..W_u...k........P./..B.F..f.5q\B.....3bDlWOW.Y....@...@...&_.6..X..K3t.y`.....y).1.....l..S].....5...7.W..1&P.I..XT..a.... o[S.f@....`M:.F?.....\|....{.7Bk....\..}..D.Z.iF{H..<...^#..dS.......0.W.*.B@E.y..Z!./7{.9.p.66.....K...t.....".Sc.C....~O.T..Q...j....c..eC.\.N...:v....p#.....".}y..z...b.............)@D.C...9M..D........}X..nC..R..}..P5.....}5..v0...D....q.^.v.T:..iX.X/.....J%..~qbU.8..hq..x.).X>..N.t.4...zK4

C:\Users\user\AppData\Local\Temp\4c70e074-7748-4605-b74a-dd691158879e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	216368
Entropy (8bit):	7.987046291990958
Encrypted:	false
SSDEEP:	3072:vJ8G5l2CkXcSrA4vHE2LXgr5OqZB+M0ID5/zZsKAWiHSD1m6NjqdTg07EGUDaIP3:vJp2RXUqE2LXkRZB+ZIdlsxaN+dmH
MD5:	A5D678749BD58532401BC0AB2F5BD5A1
SHA1:	B5E1A2CFF448AA4D49F87150206E918621EF9904
SHA-256:	DDC564EE0D9ACD8ED04097E0D5D2CAAA0ADFFFB5155C10D1416A1BC61D38647F
SHA-512:	6AD0A82F39191D69719574B380227CF97BD9854A9C1CB6BAC8A0D07F475F364C17730B775B19166AA04AA70791773980281FE7AF5754933CBAE119D2EE0F8F16
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\8c8c7e46-1b11-45c5-af2d-e70df6cb0a82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\Additionally

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.6168183228648205
Encrypted:	false
SSDEEP:	3072:RowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLt/:2b2j6AUkB0CThp6vmVnjp/
MD5:	196184062F217B1EE4BC3E1CD082194D
SHA1:	D4F2277FAD9F7152080468FC6426F22066AFB969
SHA-256:	0DB963DC202F62DDB40EB1B44133E2959C1986AEFA60558186D026E3E73DD036
SHA-512:	8960DF9DC8648B0720D242402019F122CE5E7D82B8A8BD08BFCE9AE520147311EF47000B37E52EC7489D09461487573962661C3322102B6003EF7A6AA3B0A4BF
Malicious:	false
Preview:	.I...y..f...f...._^]...U..E.SVW.X.S..`.I.......;.~...3.@j.Z.........Q.m....Y..t.SW....I.3.f..w.._^[]...U..S.].V.u.W.}.S...W.E.....I...xWf...tLf.}..j.Yr.f...w......f;.t2f;.u.j..w......Vj.WW..D.I.j...Xf9.u.j..w........x.3.@..3._^[]...U..SVW.}.j....[f;.......j.ZjHYj.^f;.v.f;.vnf;.ti.]..u.SV..8.I...ypf...uj.{.V.....E...M...p.I.j.Xf;.t#j.Yf;.v.j.Yf;.v.jHYf;.t..E.f...G..%f...E.PW.......u.V..p.I.W.u.f...W....F._^[]...U...(S.] VW.}.f.?$..O....E.P..l.I..G..U.3.RV.u.u..VP.Q(.u.u..................G..U.3.WR..WWP.Q,.........}...@...E...E f..t/.u.j....X..f..R..p.I...f....f...E .@..D.......@.3.A+....E.E .@..E.3..E..........N.j..M..M.^.}......R....E ..p.I.....M....f.4......E.9E.u..u.!..E PQ.[{..........E ...E..}..M.f.4P...........E..$..B.E.@...E.;E.r..B....E.P..p.I..4.E...@..f..t'.u.j.Yf....Qj...WWf.....D.I....G...D.._^[....U..QVW.}.W.@...W....p.I.j.Xf....w._^Y]...U..QSVW.u.3..u.....I...3.j.Z.G..........Q.ij..Y.u...S....I.3.f..{..D{...*t...^u.3..E..@..f.D{.S.4..sL...(.I...t.F..$\|.f

C:\Users\user\AppData\Local\Temp\Arbitration

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	7.9972772382424955
Encrypted:	true
SSDEEP:	1536:Q2NdWGee98UZjIzMo8pL7aNHrdTr+GAwUMR0ScodN7T3mS:Q2S1/Mo8pPG2wUMzcK3B
MD5:	51EE3B59F2D75AA8436410E472797414
SHA1:	FCA65FCBAF05C853ADE0E4A64E7AC393314B6B65
SHA-256:	8FA4002810E0DC5C3CA384B54E93A49EB21A3B1FAB6700BF6B174740053F0A7F
SHA-512:	7245C7818B8CBED42387601AD5D0FB2E82549E95E903B240D73545A56E9E39C2DB7DD44DA3DCD476B1E454162D8E5B5BE53CCCDA9893A6826B600B8C67177340
Malicious:	false
Preview:	.u...ruc.(}./..D..B...>.....\|o....z...v......J.. h...:..payb..8.K.F..=..p.....5S.t..q....l..bK......].LZZ.Dq..H..........wO'g......Vz+....a..qM..8s.2.[7..Y...7......7&ve.I.g?.../.5......C..WY.....`.1....BIF......9.....6.>.?...QzHL..I@.s..a.M........}.R......J.7x..v1..0.rPu..\...gmh...SM...$.e..0.(....2ny;yw....R.......q..........H.d..S}.2.!..F........-$wg..ZEf5.....tQ..v......V..t.....I..M.A?....F.{..>KP:.b.f......O.....1...9+..M...t/....M,-..N=!...V\.H[0Q+............E.a{)M./Z..1H.B...<<..^.#)3...-......&f....6n...A$..U7e.. ...+2F@pPn..35-.\....8.%%.....V..jwz.....2....@^..+3F...x..3........+.@q.,.9..iT.d....%...t.K.X...Xt..X...^9.)&G..eQJz.T./.V...i.s.u..e.h...W*...\|.....d.cNn..8.-P..4...o.>..3eM!7...k~~.,V.J.83...Jmbf.iI.I..4....7D.j....[...Y....{...e.b`..Q.1(.`.r@.....4U8.!I...............anZ..uX.H..Q\..G'.^`...M.}... .......Vk.]u..f..2.......4`.A.'.7......Z...>.u.......P.GRBiP.q.,.o.j]"....v......&.B..22.Fz..Af...x..c..

C:\Users\user\AppData\Local\Temp\Celebration

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	6.442862671314507
Encrypted:	false
SSDEEP:	3072:ZfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz3:ZfhnvO5bLezWWt/Dd314V14ZgP0JaAOT
MD5:	70B49061D3D2D035923B2FAE2603027A
SHA1:	8D2C2A7436D6A402AE6DC0EB94BAE4BD19AA00A7
SHA-256:	04261EBBDD3D5868D5B9D14BB3D3B83E8ED2324DF8116E8711AEE0E5C8D87BA8
SHA-512:	D01F59D53DADBD5E0A1C4C6FCB9BEF7CC0CF085BF17BEFA2E6B3EC3FEDCB99667FA765852A6F9B68FD9BCF6868CA401340F8F96519EE3370A3221EBDAD56F01B
Malicious:	false
Preview:	E......@.Ph.......X....M...F...M...o...M..E...I......u.........9....F.j5Y.M....].f9K..]..M.u(.u..M.;..u..M.t..E..M..0..F.....F..M.B.....jG..B....u.^f;.u........}.......t...B.Ph.....R....M.U.R...P...u....F......@.Ph.....+......E.PSV...f............E......F........A...U.f;E.......jNXf;.......jGXf;....................A..AjNXf9E.u).y..u#j..E..M.PSV...:...........u.S......}.......t...B.Ph................M.U.R...P.....S......F......@.Ph.........E..e......e....VPS.u..E..................E....@....f.x..t...@...Pjr._.........E....f..A.......u.M..9...E...P.E.P.E.P.E.Pj..:......M......C....td....RtQ...t3...t ...t..M..E.P....'.u..M...D...2.M..E.P.......M..E.P.AD...u..M..:.....u..M...J...E.P.M.......]..{..u...j..W:...u.M...8...E..P.E.PS......M....%C...M..%l...K.u.M..8...E...P.E.P.E.P.E.P.u..S......M......B....t.......u..u.V...X......M...B...M...k...M..E...I..M....u......Y_^[....S..QQ......U.k..l$....X.S.VW.{..R..M.jH.....^.u......f9p..u.u..D......@.Pjp........7....s..M...

C:\Users\user\AppData\Local\Temp\Centered

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	SVr3 curses screen image, little-endian
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.298852999333845
Encrypted:	false
SSDEEP:	1536:qzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNv:qPdgQa8Bp/LxyA3laW2UDQWf05mjcv
MD5:	065C79BD87BA612FAFED19E46292461A
SHA1:	47C22B8EE2A6C1895468B1558565F05C6E8FDE1B
SHA-256:	FF53BFADA5B1E72D63E014418A3B052C6B86F67CC45838E4FD508DB333BFF841
SHA-512:	754C4FCD369C97FB26F88D887CFFB9CEC2E9F185B19833E6E4E48E518F76ABAE09095150DBD034C2B73CC20F93FF4B829EC05BA1A5C7CF16C60712B8611AB5E1
Malicious:	false
Preview:	...\$$...M..............\|$...F........M...D$ .\|$T....M....O.D$U.D$..\|$L..$..........}..u........t$H........../....tC...u..A.........U....C....C..8.......j.S.'.......G.............M........{....;......^...h..M....B...............u..A.............j.............h..M..F...........D$...........F..T$..T$4.....u..A.............L$.h..M.......D$9..?...h..M..L$0.D$...........L$,.............F.........}....B....3.n......j..s...........................$.\.A.h..M..L$0.D$..........L$,.D........:....}..F................u..A..............u..A.................a............K.....F..T$..T$4....h.5M..........=.5M........h.'D..)......h.5M..q.......w...h..M..L$0.D$...........}..L$,.u....B....F.....p....\$(..P.2..........K...D$4.\$,.D$..D$0.D$..E..\$$.....~..........>...=..M.........?...=..M....4....=H..Q......D$..@......@..!...h..M..L$0.D$...........}..E....@.....L$,...\$x.............D$x.....F......N....=..M....#....<..Q.....C..C............9.A...A..UE...A...A.PVE..ZE...A...A...A...A...A

C:\Users\user\AppData\Local\Temp\Characterized

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.997110872680099
Encrypted:	true
SSDEEP:	1536:1xxN0+MHiaO+Ry+3eqVaTU7NgSB31eiASL:l2+KOTeVaTDC31ePm
MD5:	2ACC9E4A4F9B36882016DF4C6B92A452
SHA1:	CF2B86540CE24890F57D463AE29F21FB27EB8D0F
SHA-256:	FEB0396EC05CF74B1A30FB37FDC521ABFAAFA91977DC915D3A3C405DBA98C3E2
SHA-512:	12C9F46483D6C9779327E9BF0490392FD1B1E3B9A4E9463B1A464D4F13ED4D2270CA406ABCDE409DA11247BE2C43ACF2EED364BB868244622B257B33990A0576
Malicious:	false
Preview:	.R....^.Vi...n,.....H....x.O....]..\.J..._......87......]n...T..?I.....$uC.....8..........7v..2J@.1Gd...x..J......+L.....8......y3.QG..,\|.....o..y.D..<.....x...V.\78..8..Y...M..i..Q.p}U6I.(...L).@.A\mv.S.....h..6.....R...B.Ra...(.@S....e`......$.U.]......i.F...nS.t.U..}...)2...k...._..q.W.....t....S..........d},.........0<J.l?......qZ....'?E9....!..]4:@.pL.\..QOL.X<>.P..~......H..e..1..sF.^E-..eDQ..]wN......5.....'...g.9j..2Oq..J.Y\...\|...K.%.j.<..2T..>.~.i[.l..&F.....{.<D.o.G....I.sJ...$V.h"C\|)...?.Z.W...6V..\.2..Ts..W_u...k........P./..B.F..f.5q\B.....3bDlWOW.Y....@...@...&_.6..X..K3t.y`.....y).1.....l..S].....5...7.W..1&P.I..XT..a.... o[S.f@....`M:.F?.....\|....{.7Bk....\..}..D.Z.iF{H..<...^#..dS.......0.W.*.B@E.y..Z!./7{.9.p.66.....K...t.....".Sc.C....~O.T..Q...j....c..eC.\.N...:v....p#.....".}y..z...b.............)@D.C...9M..D........}X..nC..R..}..P5.....}5..v0...D....q.^.v.T:..iX.X/.....J%..~qbU.8..hq..x.).X>..N.t.4...zK4

C:\Users\user\AppData\Local\Temp\Collectors

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	6.692306020456643
Encrypted:	false
SSDEEP:	3072:EBiqXvpgF4qv+32eOyKODOSpQSAU4CE0Imbi80PtCZEMnVId:EB3gBmmLsiS+SAhClbfSCOMVId
MD5:	24EC42BC2E49E4704B8AA605C4867D8A
SHA1:	9666C7EE196A51322A2D8742D27DC8798A172387
SHA-256:	04B613AB931F6F1D710DC7AFD26A67374804524F55635EA5247E1D2F507CB422
SHA-512:	60FB14406708394352C74DB29106A768A855CBA6F04F55C021EA7908042CF90B73455C3AD2ECDE1BA7E07F1949C416CDEBEB12EE203450143C5BAEB1B3A3B8AF
Malicious:	false
Preview:	...........F.Y.......0.....................F..0......P.F..0.F..p..0......P.,.......................~..........t.........P....W...........YY.M..._3.^......]..U..E..M.S..............:.t.A....u...A..t(..<et.<Et.A....u..I.90t.8.u.I..AB....u.[]..U..M..A.<Zw.........J......3.E.......J....].....U..M..A.f..Zw.........J......3.E.......J....].....U..V.u....P..r....e..F...P."....Yu....P..r..Y..xu.....E.................F.......F..u.^]..U..QSV..M.Wj.Q.~....'..F..e..HP.....M.......F..8"t..E.;F.r..F.....2..?.u...t..._^[..].....U..QSV..M.Wj.Q.~....'..F..e.....P.]....M.......F..8"t..E.;F.r..F.....2..?.u...t..._^[..].....V..H..........u....^.S3.9^........:..........B...........^8.^......F.9^........v...F1..P.!....F....t....w..$..rB....X....E.N(..^$.^0.^ .^,.^<.8........'..........^(.!...A........................h....F....F1....k....F...P.....P......J....F.[^.I.\rB.erB.zrB..rB..rB..rB..rB..rB...V..H.........u....^.S3.9^...................&...........^8.^......F..9^........v...

C:\Users\user\AppData\Local\Temp\Comics

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.9975788632921
Encrypted:	true
SSDEEP:	1536:84Qg4n6e81g/p3+ih9ysmP7UHIyMQMsN3wPCgAwHRJEcT8fKSvkJRV3/Z9HcWJxt:og4nc6B3+OA/IVMQMLCg3R5qcX/8WHoM
MD5:	9506A47C8180BEB01080FEB604F759B8
SHA1:	A91C6B59781C7E927F5ECCBD78BFFDD2A6F089A8
SHA-256:	16181729D36A55187FDC0676EB947CDF9E76F12FA0A26CB9751520EFBE5FAF71
SHA-512:	7C845EFFB688A24B9361C7C42BBC1386B3C04A9C22D689840BCCBEFDF3C4362ED70EF0EE3029671969C04EB321F319461B260F6DE5EBCA0935BCC917A26459C2
Malicious:	false
Preview:	.D...B...\|..Y...8..-....d..M.....^...p.1..n.g.....s.A9.;.W......g.R.?.....>..rA..2.O...,KN..'.R..w..>L(e......}....q...C._....^.L..R.L..6..+X/.<W.!.....Qs.......V2...&MK.U.<..L..nu.g...&Gd.....i.T....X.O.iPOZ.......D..3g....W..,..f.4......k_uHA@.X]-Tf..{......V$.n.C.;.9......3..gc...._.U7Kg.....I...C..`.VE.?....b..8...+v.j...C(..0.7.imL..P/.._./...}./.=\d..\\|;.S.v.S.AJsl....&.7.#.5~2-8m.H...SY.T.g.....W.,.....E..&K.....7.M Hg./d......?.0P.._....#?(.>{:...@......R.,..G....6. .Z...cC.HY..1.....0....8k....me..... ...;.Z.Q..D..'xM.D......sv.>Z.......#.+...}(...U7?...H...$.......I.,zx...B.$l../5.\|.../..^"..!K.Im.....JZ>.S..DM.].P..[../.'.u...<z........C[.M...l.{rO.Y.r..-.#..f:.W..\|......^J.M..A..E...<.....^e...V....1......[........e.y..k....IJ...N.E..![.....v..itV..<1..P1..gx.%......'..,V.?.b.*.++.6.....0,.m:~e;3)..t..(.T.V..!..8..=.......c..6.'.s....y.2...\.5)!...LW..\.f..m-.....jQT.D./N.r....e...&.1......@.l..Z........2..$)...B.1@nO.x

C:\Users\user\AppData\Local\Temp\Entries

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	7.997229694184693
Encrypted:	true
SSDEEP:	1536:UVllbkxqzMzr614+wlQh7RwluGUE1+SkrpcHCqnUAJY54qd/:UxvkWHwll9+S2cHXUAJY57
MD5:	5350FEC9430141A588801BDEBD3D1E55
SHA1:	BC0896EDC7909334F6A48EB1EF1C73B7AFFCC9FE
SHA-256:	FB7BA0E0D9D7DFA6C6D2EE945BEA51790611FA2B826DB36CED6F5599CB7B0773
SHA-512:	3432F6D39813605CD33045C1C2773626C010827E5B019E652D5C1FC06CD72BB98024E7D0CF817656142A1EF57B8BA195B1350399DE78F661AF98549B44FCBC61
Malicious:	false
Preview:	..q..f.Aq..I.da.$.....A$.l..L...p..c.o..w..V.qf.y?U.!....> ]..293..1!.".xX.Ry1.......4"..C........p..(......9\...K.5N8..k7C..m5..)cU......ZX.k.....9~..z...Bfh..l.>.6....X2.ca..i......>..0..z.%.....'$....7a..6.xM..a}.K...}...~.R.km..9P.....X.....JiC..T..[......].&..Btb.Ou...6.~............B!">`.l.{.....M^....B.8..aNl..Q..=...R...).o...f..yT...~Gb..M.255....D..O#X.q.<y.K.O.x.f.o\|.}v....o....>N.5fl.{X..^..4v..m...bC~A.6.m..v..N.x^.....&...C,...[...8..l..`.k&...BJ.....u.l.......X}b!...z...b.....`.9....)$o..>..\.....0Op'LU.OM......)..S..:U.....G.X......L).U..4la.`..d....w..$....R....Xkio..\|fK.(.r..[61-...F}.-....4....1%..9'11......b.L.+Twl.M.~....].4.(.oh3.".....&.J..sW(Da.0WC.F.Rw..........C.....6$...(N....Kd.;M\.#6.W.t...P..92.>..@.......H.&..{.. ~. 3.B.2?%H.:4l..0t.+N.b[.....-d...Y.!..A..zg.sw...3.^...Zet.j%`..mh.~.IN>>...K4.^.H!..=z.....i.X....S]R?.Ep.L......{..@!(Re.ae3...~..Q.@...i`..;I..\<58!..SY.X.=.-...4.-...}J...:.~.......

C:\Users\user\AppData\Local\Temp\Flesh

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.6667439829091535
Encrypted:	false
SSDEEP:	768:lQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mexg:lQuklMBNIimuzaAwusPa
MD5:	EF7E28192889B4B827FBA17D8B4F0DF1
SHA1:	5C839A9769A736EDAF69425FC13CEF95A6CD9317
SHA-256:	A6FD8B35BD97FE198AC52518BF8F77A7BDF86FED87B344ACAA0EE85D4D196F1A
SHA-512:	97EC984D3210F04BD82EDDF41BEAC0CD2E1BC7806C2CF1797AE832B074A34F675C8239FDCF952AD404ED3C9021B1CD59C0DAD54AA3EDE5339CE1A628C866C149
Malicious:	false
Preview:	L...?.&Kr.QF>.......?...,...?.#/.'..>.......?......?]X.c..?>.......?.......?...}..>.......?....e..?.I.dW.A>.......?.....K.?.....?>.......?...X.g.?..4..A>.......?...._..?.[...J>.......?.......?1....0H>.......?......?.hc#.]G>.......@...,..?.Q.x..F>.....@.@...p...?ek.R..N>.......@.......?...n@>.......@....b..?......O>.......@...$Q/.?.CJ...O>.....@.@.....E.?......G>.......@....[.?.3.E.{A>.......@...T.p.?.SfI.S:>.......@...X..?B6).1.<>.....@.@....3..?>....7>.......@....$..?s(....N>.......@...@...?V..6.f=>.......@...(...?..{....>.....@.@...(W..?..-.Jg >.......@.......?.."a.PK>.......@...xm..?,S...6>.......@.......?.6..hb">.....@.@.....-.?.k,...<>.......@...X.>.?.0....=>.......@.....O.?..IX.H>.......@....-_.?......@>.....@.@.....n.?....2.E>.......@....P~.?.=...8>.......@...lj..?..[j&,>.......@...L7..?..x..82>.....@.@.......?c.#V..B>.......@...0..?7...Y.>.......@...P...?..[..p&>.......@......?h4.M..A>.....@.@.......?E.p.l.E>.......@....+..?.o..$.E>.......@...h...?\...*.K>...

C:\Users\user\AppData\Local\Temp\Geographic

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	Microsoft Cabinet archive data, 488581 bytes, 10 files, at 0x2c +A "Mw" +A "Additionally", ID 7440, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488581
Entropy (8bit):	7.9987032929913155
Encrypted:	true
SSDEEP:	12288:2iZfDH5ssa/ToAmp4Bo6ex2Yx8Ytfp6TJeRqaSYZJJEOCD7DaHv:/hDHi3boA84K6ehWM2eoYJJEOkDaP
MD5:	E5EF57C22315CD79A41923A265F75376
SHA1:	8B7C2AA87DCA8E636269C3E0B7B8DB63DDB63CFA
SHA-256:	E3472BF000389EA74A7BC8B4EE93E39870558782844062D6C42BCC6FB691271D
SHA-512:	99E9AC97E65DD459AFD4D57143645C5FA74E7570EE293FE76932635F194AB7E06884672BEB5DC6F5E93FAD30D9219A8927DDA23F4239FE246027123C42D6B4C7
Malicious:	false
Preview:	MSCF.....t......,...........................x.........<Z.> .Mw.....x.....<Z.> .Additionally.....x.....<Z.> .Hood.....x.....<Z.> .Flesh..\..x.....<Z.> .Centered..X..x7....<Z.> .Waters.....].....<Z.> .Ventures..T..] ....<Z.> .Collectors.....]t....<Z.> .Visual..0..]D....<Z.> .Celebration...#..Q..CK.}\|...8>.;I&..,..........EI.A.`7..7...c.mu../.0.A..:..}j.}.}..V..V...P)n...R@\|!..h.....a...=..n^.}.........s.=..s.9..;7.J..2~.9..._.9n.g..s.._6.q..:.{)./....2.....r7l...6.zw.wo.....=w.rO......{..o...I.2...O......h0...ye.0{:.?`.E,.1--.wx.;..;Z..;.g.........O....d.Z...U4...;...\|...w.......?....g.k....?.7...V.)..g}'...].g..t..'...D..Y..H..5\|....g..'..d... ..q4..s......puX.3......f2..Rx.O............9...ec.!}.XB;.....^!.^+.s...F.....<..w...o.U...~9l2.>..W.'.z..0.q;7`...[.0-..^.q....;.+....y...m....CF.;...{..... .....Y..[E5 rj................z.g...H?LG.s.7.H...8d...'.OZ....(.{...I.".-.^....[.8G4..[.be...T.>.X....v..5.U.jfm......yu@.......E...b"....M^.p.(.!N."./..u_

C:\Users\user\AppData\Local\Temp\Hood

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.538778333385485
Encrypted:	false
SSDEEP:	1536:I1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJR:IZg5PXPeiR6MKkjGWoUlJR
MD5:	36875CF20A093095236CAB0B17B682EC
SHA1:	3EFDF8C68A6868E5A1DA64C93E1B2FA67F914F9B
SHA-256:	3F080FAC1FA9B856A7D5C0E25EB26426D0FC2E7F7C6DCAF2FC428BD12E92D41E
SHA-512:	B40E640E057DA5A76C023402D392A0E58BEA3AC05F7CA6F49EDFB1A7F38F17414638A24012F4CB74DC5E7151B17EDDA3C285B4D1620488C8926E4C5A4D78FFE9
Malicious:	false
Preview:	..............................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.s

C:\Users\user\AppData\Local\Temp\Investor

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	ASCII text, with very long lines (574), with CRLF line terminators
Category:	dropped
Size (bytes):	13482
Entropy (8bit):	5.140645910733901
Encrypted:	false
SSDEEP:	192:WarQtuxSu3eHUB5BjbQQBKk607aPT27ndCZQueLaLZEwm24vscM0X:WaEwYu3ekSQ/d7aPT27ndsQYaGlH0X
MD5:	AA7E9623FFDD0567D6B711DFA8A49791
SHA1:	F1E12BF3A2EE0D42C8660A51832FAF87E6150519
SHA-256:	762B8C8342C4ED0550D9B59B04582265197145E7CF37D6063D50E082AAB86648
SHA-512:	E277089303D6C58C8CA1DEAEC46AECB543318968F8AF8074988B6D724E0CF598FF548548C44F6B439B040F11DE639A6613A3315796948DEC311F636282309FAC
Malicious:	false
Preview:	Set Impressive=i..GOkPic-Selective-Teach-E-Boxes-Dow-Motorcycles-Microwave-..DdnMeans-Insider-..JUVObligations-Flat-Query-Unauthorized-..ayoReturns-Vbulletin-Find-Indonesia-Packed-..LvDZBound-Controlling-Strong-Forums-Mines-Safely-Saint-..DqQuizzes-Tba-Stopping-Dpi-Estates-Basically-Vegas-Same-..ocyRWife-Aged-Medicare-Prerequisite-Reduce-Avoiding-..VjHats-Korea-Flyer-..Set Creates=N..vlPVQualifications-Demand-Consolidated-Excess-Wildlife-Reporting-Navigation-Dangerous-Defense-..DCjShipments-Race-Musical-Terrorists-Double-..muLocale-Potentially-Noble-..yOSending-Updates-Ocean-..gdDThread-Generator-Performances-Text-Hardly-Places-..Set Discussions=j..ozhEAre-Danish-Chamber-Debug-Spell-Dg-Nominations-..AIPCNationwide-Armstrong-Hc-Picks-Seeks-Stays-Computers-Many-..sGbGTom-Lanes-Munich-..jMLeisure-Off-Prices-Clip-Hidden-Coat-Big-Whatever-Oscar-..QPNBiotechnology-Habitat-Lecture-Mistake-Hills-Groundwater-Combo-..Set Egyptian=/..wYNLBad-Mardi-Gothic-..dknLater-Permit-..FGyPlans-Sells-Profess

C:\Users\user\AppData\Local\Temp\Investor.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (574), with CRLF line terminators
Category:	dropped
Size (bytes):	13482
Entropy (8bit):	5.140645910733901
Encrypted:	false
SSDEEP:	192:WarQtuxSu3eHUB5BjbQQBKk607aPT27ndCZQueLaLZEwm24vscM0X:WaEwYu3ekSQ/d7aPT27ndsQYaGlH0X
MD5:	AA7E9623FFDD0567D6B711DFA8A49791
SHA1:	F1E12BF3A2EE0D42C8660A51832FAF87E6150519
SHA-256:	762B8C8342C4ED0550D9B59B04582265197145E7CF37D6063D50E082AAB86648
SHA-512:	E277089303D6C58C8CA1DEAEC46AECB543318968F8AF8074988B6D724E0CF598FF548548C44F6B439B040F11DE639A6613A3315796948DEC311F636282309FAC
Malicious:	false
Preview:	Set Impressive=i..GOkPic-Selective-Teach-E-Boxes-Dow-Motorcycles-Microwave-..DdnMeans-Insider-..JUVObligations-Flat-Query-Unauthorized-..ayoReturns-Vbulletin-Find-Indonesia-Packed-..LvDZBound-Controlling-Strong-Forums-Mines-Safely-Saint-..DqQuizzes-Tba-Stopping-Dpi-Estates-Basically-Vegas-Same-..ocyRWife-Aged-Medicare-Prerequisite-Reduce-Avoiding-..VjHats-Korea-Flyer-..Set Creates=N..vlPVQualifications-Demand-Consolidated-Excess-Wildlife-Reporting-Navigation-Dangerous-Defense-..DCjShipments-Race-Musical-Terrorists-Double-..muLocale-Potentially-Noble-..yOSending-Updates-Ocean-..gdDThread-Generator-Performances-Text-Hardly-Places-..Set Discussions=j..ozhEAre-Danish-Chamber-Debug-Spell-Dg-Nominations-..AIPCNationwide-Armstrong-Hc-Picks-Seeks-Stays-Computers-Many-..sGbGTom-Lanes-Munich-..jMLeisure-Off-Prices-Clip-Hidden-Coat-Big-Whatever-Oscar-..QPNBiotechnology-Habitat-Lecture-Mistake-Hills-Groundwater-Combo-..Set Egyptian=/..wYNLBad-Mardi-Gothic-..dknLater-Permit-..FGyPlans-Sells-Profess

C:\Users\user\AppData\Local\Temp\Japanese

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	66752
Entropy (8bit):	7.996860122458265
Encrypted:	true
SSDEEP:	1536:TRqlANkU0xENBE1VmT/ULWXYikc4ZqlE80KULzNGoOziwAo:TRvNB0yNBcmT/YWIiP4Zg0KwEoOzim
MD5:	6C3BF929703CDE7FE854D3ED9556557A
SHA1:	8B3811720F4A4823052F5CDDDB39FED519796D22
SHA-256:	2A30A1BFBB6FABD6A810ECFA48D4D231EF2635861F2E628626E436F5F56407DF
SHA-512:	66F8278DDB15154BCE7A62C87FC26C9CFD7F6814752FC250EA77E05D862787EC65883C00CBC8C008FECBCC5A94A9E52C293F00D3D2F990B07A4270E53AC18C99
Malicious:	false
Preview:	.lH.w. ..wx..0)..\.Y.Y..7K..^....o.$,...YW.>...#ia.".l.....6....t.........q...\|..`......m.m.$..K...9...0g.y.....G.!si...f.....]...\|.k...H..&\..=....j.....,?>.4EU./.,.^@..SM...z....F/vcyH{i!..X.NI.`.%.{.4C.-...F.W..2<..D...r.B.:.y(#.P2Y.....D9oL........s..a..A.D.fk..q..~...........\\..."....L=..8..m.a.........e.z.s...%j0^.\|...9..z.......-$D...D..P.."...F.IG.7?}g/AS`.>#.[....Y....'g...G.K.d..........d:...mcu/X$...4v.}...Q.....W.....w.......j.LW#...K.v.`!..;P.f_.m.n...~#..mO.j.....>.w>.&n.-...[..... .....6P@....u$...............+\|Z.....N.^...A...8..mR.........x.....Q......L.W.&....6...u...4>J.="...)...............Xu{.b.../..8.sB.Yss.r..[.v.[6.^.~..h......G.h5u.y.e.&<+..b.....h..;..j.....E...l.T.2.u..t...H...ra..u....:.D..#.%.*?.X.1...2o.&...`._......L.pIv..8..~.........m.E.zV.I.....;....yf.-..6..<8K.\..0P)....p`t......."..>....0..Eq... ...e..u.~.D.~.^.D.@...<^.Ian-....Q..)@0.o.....R32.........JT.#.;........P9.....#.....(}.....7eX.+....

C:\Users\user\AppData\Local\Temp\Mw

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	888
Entropy (8bit):	3.5642782907476596
Encrypted:	false
SSDEEP:	12:qFyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1:myGS9PvCA433C+sCNC1
MD5:	84565538C82EEF249BC5E4956307F274
SHA1:	187E5C2697D4C50D15F07A8B3A4090CF35CFDB12
SHA-256:	C5D1C5C0915562F4800560449658AFAD60874297A51B4513945657FB38EC6D68
SHA-512:	6ED9B60A88EDD475783AA0188821B6310045502713EB4D890BEE5FE074458DDFBF816FDE6F14985BB1789E6A168465EAF0C083DC21ED3726EC492658DCA16E7F
Malicious:	false
Preview:	TEAMS........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Put

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	modified
Size (bytes):	72704
Entropy (8bit):	7.99761144180448
Encrypted:	true
SSDEEP:	1536:PsY1qWkr7Frx/W6+HhRozHIDYVuT1RfGa/XrrLM:Pj8Wkdn+BRow1RuurrLM
MD5:	61759B9899AF7D6300BCD4D6EE9ACF56
SHA1:	570F7B32573E3F62EFB8A060F21690339CD419BC
SHA-256:	C45B275D05E38ED38703650602E5FFE5FBA338973D0A6806BA34D4533B7E8CAE
SHA-512:	19A4AC84B7DD8FF201D2526E79D0CA2776363946AF8F8F6A782C120124A45CDAB778F9D747582D8CF3F01B03C02A107C4E622756EE469C7B91AB90E1EFC6DB49
Malicious:	false
Preview:	q...K...h...`...0.~OB..b.{.......9,...3M.f0.@.9..?....I..U.G.^.% .IM-.dW..+\..A}~\x4.(..`.AnI.....g.....X....l...-...L"..#....2..j..%..3..f..Do.......0)1nS.%...j.i.&,..T...#`.M...s.;M8.n.7@.z.e..de.)..SFN$...Rc....,.v......y..].f._.....^. g/.8].K.+a'...l.ar......9>9}..)ZC.T....=....T.....O.'h&.......r5.\..RO.[.n....f..._....Rl.&=....onqy.I0....GF...\|.xc,.P.I6..7........1.\|.....`YFO...v.v.ih.Q.....}B.sa.v$.rJ..<...e+....v.z8u..W....l....dfo]].'\..@p..A.......fb.!w...L..c`..w...us.ht.5._.........@...u.%.F..d..S\|%......Y...Y....g......@:P.....f...M...k..9....g.F.:....N....pf....4.W^..0....9...c....D.@4.P......y..mkz.{....~..Y.Z..Ea.m.3(..............a9.......pr..V.....P)...Rb.<n..#%+h\......T...lM...J.v..$.Vn.s.:e. .'.....CSKcp......lY`....!....\xd.....9?r9oF.....+.}.`....O.D.Ib0.> .........(H..'..M.G....y..-.h....2)~P.9U+b.H>]..sk.K....Z..qJ..h..\VO.}.`.z..=."..X...5.`..e......#v\|F&-...5E..?8.mR..G../C.B..4]....Z..k...s..=.~....bx/?k..9....

C:\Users\user\AppData\Local\Temp\Ventures

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	IRIS Showcase template - version 38
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	4.490560154824957
Encrypted:	false
SSDEEP:	768:YSGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3Eh:QKaj6iTcPAsAhxjgarB/5el3Eh
MD5:	5A93E026F0BC5713CC26B060432CDCA6
SHA1:	A8790C3B716791CF6D59845298C0C91F05938D4F
SHA-256:	9179D0812AAFA0FA28FA0EB7EE7048A302C2A3EC5BD2BC49B973E6FA6900574B
SHA-512:	58A5660C43A9A91A81FA826F1691B48EE309FCCEA00BFA894AF1846328A2875B8EC31EC70E48CBCB9D57B480FA526DBDDDDE2BC7FB9BABC1274D80121AAC3A38
Malicious:	false
Preview:	.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.%.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.r.r

C:\Users\user\AppData\Local\Temp\Visual

Download File

Process:

C:\Windows\SysWOW64\extrac32.exe<

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dbi5x\4o8yuk

C:\ProgramData\dbi5x\6f3e37

C:\ProgramData\dbi5x\d2nyc2

C:\ProgramData\dbi5x\djwl6p

C:\ProgramData\dbi5x\dt0r1d

C:\ProgramData\dbi5x\ek689r

C:\ProgramData\dbi5x\f3ekn7

C:\ProgramData\dbi5x\fctr1d

C:\ProgramData\dbi5x\gdbi5p

Windows Analysis Report
random.exe