Windows Analysis Report
{89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml

Overview

General Information

Sample name: {89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml
Analysis ID: 1541127
MD5: 2d3c508321b32b43ee4192d54bc0ed15
SHA1: e60a6dc0e6374c5adffce59e1b34635769e39767
SHA256: 96003b2bc14e105d7649310c9f5f0cb1b71c809a17b07a6456be4e4841cba187
Infos:

Detection

Score: 22
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Maps a DLL or memory area into another process
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
IP address seen in connection with other malware
Potential browser exploit detected (process start blacklist hit)
Sigma detected: Use Short Name Path in Command Line

Classification

Potential browser exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.4:60213 -> 1.1.1.1:53
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 13.107.246.57 13.107.246.57
Source: Joe Sandbox View IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.114.95
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.57
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown TCP traffic detected without corresponding DNS query: 23.218.232.182
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730374811&P2=404&P3=2&P4=eyEJMar66EjaXc1c2IncUP9ze73ukP9o%2fV0XCTSV%2foCCD6NGtFh0LNITjmaYIDF19tiwKN%2bYOzX5ESmgnNrXsA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ALZO8dbXCPrwsCnxqsS2LgSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: msapplication.xml1.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x8e1a23a1,0x01db2609</date><accdate>0x8e1c98b9,0x01db2609</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x8e23ba83,0x01db2609</date><accdate>0x8e2603e1,0x01db2609</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.1.dr String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x8e28755b,0x01db2609</date><accdate>0x8e29b5d8,0x01db2609</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: 200.163.202.172.in-addr.arpa
Source: unknown HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ar.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ar.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ar.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ar.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://au.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://au.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://au.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://au.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://br.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://br.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://br.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://br.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ca.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ca.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ca.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ca.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://cf.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://cl.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://cl.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://co.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://co.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://de.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://de.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://de.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://de.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://es.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://es.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://es.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://es.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://espanol.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://espanol.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://espanol.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://espanol.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://fr.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://fr.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://fr.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://fr.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://hk.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://hk.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://hk.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://hk.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://id.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://id.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ie.search.yahoo.com/os?appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://in.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://in.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://in.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://it.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://it.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://it.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://kr.search.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://kr.search.yahoo.com/ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://kr.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://kr.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://kr.searchcenter.yahoo.com/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://livesearch.msn.co.kr/
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://malaysia.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://malaysia.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://malaysia.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://mx.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://mx.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://mx.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://nz.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://nz.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://pe.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://pe.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ph.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ph.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ph.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://qc.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://qc.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ru.search.yahoo.com
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.cn.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.live.com/results.aspx?q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sg.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sg.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sg.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.ar.search.yahoo.com/os?market=ar&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.au.search.yahoo.com/os?market=au&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.ca.search.yahoo.com/os?market=ca&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.de.search.yahoo.com/os?market=de&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.e1.search.yahoo.com/os?market=e1&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.es.search.yahoo.com/os?market=es&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.fr.search.yahoo.com/os?market=fr&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.hk.search.yahoo.com/os?market=hk&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.id.search.yahoo.com/os?market=id&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.in.search.yahoo.com/os?market=in&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.it.search.yahoo.com/os?market=it&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.mx.search.yahoo.com/os?market=mx&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.my.search.yahoo.com/os?market=my&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.nz.search.yahoo.com/os?market=nz&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.ph.search.yahoo.com/os?market=ph&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.qc.search.yahoo.com/os?market=qc&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.sg.search.yahoo.com/os?market=sg&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.th.search.yahoo.com/os?market=th&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.tw.search.yahoo.com/os?market=tw&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.uk.search.yahoo.com/os?market=uk&amp;appid=ie8&amp;command=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://sugg-ie.vn.search.yahoo.com/os?market=vn&amp;appid=ie8&amp;command=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://th.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://tw.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://tw.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://tw.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://uk.search.yahoo.com/search?ei=UTF-8&amp;fr=yie7c&amp;p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://uk.search.yahoo.com/search?ei=UTF-8&amp;fr=yie8ms&amp;p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://uk.search.yahoo.com/search?p=
Source: KnoC6F0.tmp.1.dr, known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ve.search.yahoo.com/
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://ve.search.yahoo.com/search?p=
Source: known_providers_download_v1[1].xml.1.dr String found in binary or memory: http://vn.search.yahoo.com/search?p=
Source: msapplication.xml.1.dr String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.1.dr String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.1.dr String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.1.dr String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.1.dr String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.1.dr String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.1.dr String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.1.dr String found in binary or memory: http://www.youtube.com/
Source: Network Persistent State0.8.dr, 91c92e27-0daa-4221-ae09-6c06441a1433.tmp.9.dr String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.8.dr String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.8.dr String found in binary or memory: https://chromewebstore.google.com/
Source: fc04b53c-54ca-4b24-a922-9aadf29d9a5d.tmp.9.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json.8.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: fc04b53c-54ca-4b24-a922-9aadf29d9a5d.tmp.9.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json.8.dr String found in binary or memory: https://docs.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.8.dr String found in binary or memory: https://drive.google.com/
Source: 000003.log7.8.dr String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: content_new.js.8.dr, content.js.8.dr String found in binary or memory: https://www.google.com/chrome
Source: fc04b53c-54ca-4b24-a922-9aadf29d9a5d.tmp.9.dr String found in binary or memory: https://www.googleapis.com
Source: Top Sites.8.dr String found in binary or memory: https://www.office.com/
Source: Top Sites.8.dr String found in binary or memory: https://www.office.com/Office
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 60217 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60217
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60216
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 60215
Source: unknown Network traffic detected: HTTP traffic on port 60216 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 60215 -> 443
Source: classification engine Classification label: sus22.evad.winXML@57/314@10/6
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DF94EA510BB99C4B82.TMP Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Login Data.8.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE "C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\{89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml"
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\{89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2148,i,17130950267540690854,13973253162782942083,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2828 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5868 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2092,i,1275717734434222331,13943601166396774442,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,13810906325023881848,113091338376837868,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\{89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2148,i,17130950267540690854,13973253162782942083,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2828 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:3 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5868 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=2620,i,4059753573926837572,7725692899582869137,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=2092,i,1275717734434222331,13943601166396774442,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,13810906325023881848,113091338376837868,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: appvisvsubsystems32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: c2r32.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: slc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: ie_to_edge_stub.exe, 00000003.00000002.1756574524.000002A803C13000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\{89eeeac4-e4d3-40a8-9048-e7cecfc98851}.xml Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=1044c Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541127 Sample: {89eeeac4-e4d3-40a8-9048-e7... Startdate: 24/10/2024 Architecture: WINDOWS Score: 22 45 200.163.202.172.in-addr.arpa 2->45 47 198.187.3.20.in-addr.arpa 2->47 10 msedge.exe 32 483 2->10         started        14 MSOXMLED.EXE 12 2->14         started        16 msedge.exe 2->16         started        18 msedge.exe 2->18         started        process3 dnsIp4 55 239.255.255.250 unknown Reserved 10->55 57 Maps a DLL or memory area into another process 10->57 20 msedge.exe 10->20         started        23 msedge.exe 10->23         started        25 identity_helper.exe 10->25         started        27 identity_helper.exe 10->27         started        29 iexplore.exe 77 111 14->29         started        31 msedge.exe 16->31         started        33 msedge.exe 18->33         started        signatures5 process6 dnsIp7 49 23.218.232.182, 443, 60215 RAYA-ASEG United States 20->49 51 13.107.246.57, 443, 49751 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 20->51 53 6 other IPs or domains 20->53 35 iexplore.exe 2 22 29->35         started        process8 process9 37 ie_to_edge_stub.exe 1 35->37         started        39 ssvagent.exe 501 35->39         started        process10 41 msedge.exe 16 37->41         started        process11 43 msedge.exe 41->43         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
13.107.246.57
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
216.58.206.65
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
142.250.114.95
 unknown United States
15169 GOOGLEUS false
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
23.218.232.182
 unknown United States
24835 RAYA-ASEG false

Contacted Domains

Name IP Active
chrome.cloudflare-dns.com 162.159.61.3 true
googlehosted.l.googleusercontent.com 216.58.206.65 true
sni1gl.wpc.nucdn.net 152.199.21.175 true
clients2.googleusercontent.com unknown unknown
198.187.3.20.in-addr.arpa unknown unknown
200.163.202.172.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx false
    		unknown