Edit tour

Windows Analysis Report
Swift-TT680169 Report.svg

Overview

General Information

Sample name:	Swift-TT680169 Report.svg
Analysis ID:	1586628
MD5:	ccc997a94272656e267c53bde3bc895b
SHA1:	34f412909bdd36f3f5fa6ae5f9e70d56b9f182af
SHA256:	3d44de6a6a5358af68357af152c958173369fd96dc2ce4cae03c26795f4d8e8d
Infos:

Detection

Branchlock Obfuscator, SVG Dropper

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Branchlock Obfuscator

Yara detected SVG Dropper

Downloads suspicious files via Chrome

Exploit detected, runtime environment starts unknown processes

Found suspicious ZIP file

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64_ra

msedge.exe (PID: 6284 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1704,i,11278545449151701423,6029193152170411620,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7300 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=4972 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4068 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7224 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3228 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

powershell.exe (PID: 1212 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 6024 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

wscript.exe (PID: 7720 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

java.exe (PID: 2176 cmdline: "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 7816 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

javaw.exe (PID: 4268 cmdline: "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar" MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

tasklist.exe (PID: 2668 cmdline: tasklist.exe MD5: 0A4448B31CE7F83CB7691A2657F330F1)

conhost.exe (PID: 3956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Swift-TT680169 Report.svg	JoeSecurity_SVGDropper	Yara detected SVG Dropper	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.1774863969.0000018ECEB80000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
00000021.00000003.1727597847.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
0000001B.00000003.1762756522.0000018ECE56B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
00000021.00000002.1746647087.00000000048E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
0000001B.00000002.1773858739.0000018ECE575000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
Process Memory Space: wscript.exe PID: 7720	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 4268	JoeSecurity_BranchlockObfuscator	Yara detected Branchlock Obfuscator	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine|base64offset|contains: 1jy, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4552, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine|base64offset|contains: 1jy, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4552, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine|base64offset|contains: 1jy, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4552, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , CommandLine|base64offset|contains: 1jy, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4552, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4552, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , ProcessId: 1212, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Code function: 4x nop then cmp eax, dword ptr [ecx+04h]

33_2_028C8C18

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: javaw.exe, 00000021.00000002.1750554499.0000000009F83000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificat
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: javaw.exe, 00000021.00000002.1750554499.0000000009F83000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 0000001D.00000002.1724509423.0000000004A00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: javaw.exe, 00000021.00000002.1750554499.000000000A144000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1758258034.0000000015360000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: javaw.exe, 00000021.00000002.1750554499.000000000A008000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: javaw.exe, 00000021.00000002.1750554499.0000000009F83000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009F56000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.000000000A028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Swift Confirmation Copy.jar.27.dr	String found in binary or memory: https://branchlock.net
Source: wscript.exe, 0000001B.00000003.1762756522.0000018ECE56B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://branchlock.net8
Source: Web Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004EBC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu
Source: javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004EBC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/1.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/2.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/3.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/checker.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/email.js
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/history.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/recovery.jar
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/res.jar
Source: javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://seasonmonster.s3.us-east-1.amazonaws.com/swiftcopy.pdf
Source: Web Data.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\Downloads\MT103 Mansourbank.zip (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\Downloads\MT103 Mansourbank (1).zip (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\Downloads\Swift Mansourbank.zip (copy)	Jump to dropped file

Found suspicious ZIP file

Source: 8bd6dfcc-92bf-4e1d-9f13-f65d1ac49963.tmp.3.dr	Zip Entry: Swift Transactions/Swift Transaction Report.js
Source: d3f3b3e3-7f33-4119-88a5-9cac2852313d.tmp.3.dr	Zip Entry: Swift Transactions/Swift Transaction Report.js
Source: 5cc79d3e-11f2-45d3-81f3-99c7e047c108.tmp.3.dr	Zip Entry: Swift Transactions/Swift Transaction Report.js

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: classification engine

Classification label: mal88.troj.expl.evad.winSVG@73/174@0/3

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FB5F0-188C.pma

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_2023482335
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\468e9b01-2343-4499-851b-7b7b2b8d3a74.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1704,i,11278545449151701423,6029193152170411620,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=4972 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4068 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7224 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar"
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist.exe
Source: C:\Windows\SysWOW64\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3228 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1704,i,11278545449151701423,6029193152170411620,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=4972 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4068 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7224 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3228 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar"	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Yara detected Branchlock Obfuscator

Source: Yara match	File source: 0000001B.00000002.1774863969.0000018ECEB80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.1727597847.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.1762756522.0000018ECE56B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1746647087.00000000048E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.1773858739.0000018ECE575000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 4268, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar, type: DROPPED

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CA20A push ecx; ret	29_2_028CA21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CA21B push ecx; ret	29_2_028CA225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CB3B7 push 00000000h; mov dword ptr [esp], esp	29_2_028CB3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CBB67 push 00000000h; mov dword ptr [esp], esp	29_2_028CBB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CB947 push 00000000h; mov dword ptr [esp], esp	29_2_028CB96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 29_2_028CC477 push 00000000h; mov dword ptr [esp], esp	29_2_028CC49D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282D8F7 push 00000000h; mov dword ptr [esp], esp	33_2_0282D921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282BAF4 push 00000000h; mov dword ptr [esp], esp	33_2_0282BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282A20A push ecx; ret	33_2_0282A21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282A21B push ecx; ret	33_2_0282A225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282B3B7 push 00000000h; mov dword ptr [esp], esp	33_2_0282B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282B350 push 00000000h; mov dword ptr [esp], esp	33_2_0282B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282BB67 push 00000000h; mov dword ptr [esp], esp	33_2_0282BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282B8D1 push 00000000h; mov dword ptr [esp], esp	33_2_0282B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282D8D1 push 00000000h; mov dword ptr [esp], esp	33_2_0282D921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282C0D5 push 00000000h; mov dword ptr [esp], esp	33_2_0282C49D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282B947 push 00000000h; mov dword ptr [esp], esp	33_2_0282B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_0282C477 push 00000000h; mov dword ptr [esp], esp	33_2_0282C49D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_028CD691 push cs; retf	33_2_028CD6B1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_028CB331 push ecx; retn 0022h	33_2_028CB3E6
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_028CB077 push es; iretd	33_2_028CB07E
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_028D159A pushad ; ret	33_2_028D159D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Code function: 33_2_028EDD3E push cs; iretd	33_2_028EDD6C

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE8
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE8

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Code function: 33_2_028CB4C4 sldt word ptr [eax]

33_2_028CB4C4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8280			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1590			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 456

Thread sleep time: -7378697629483816s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Web Data.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696586537u
Source: Web Data.3.dr	Binary or memory string: AMC password management pageVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696586537t
Source: Web Data.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: discord.comVMware20,11696586537f
Source: java.exe, 0000001D.00000002.1723486279.0000000000D54000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1744586098.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: Web Data.3.dr	Binary or memory string: dev.azure.comVMware20,11696586537j
Source: Web Data.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696586537
Source: java.exe, 0000001D.00000003.1720769498.0000000014E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: Web Data.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696586537x
Source: java.exe, 0000001D.00000002.1723486279.0000000000D54000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1744586098.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware.exe8
Source: Web Data.3.dr	Binary or memory string: tasks.office.comVMware20,11696586537o
Source: java.exe, 0000001D.00000003.1720769498.0000000014E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: Web Data.3.dr	Binary or memory string: bankofamerica.comVMware20,11696586537x
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696586537h
Source: javaw.exe, 00000021.00000002.1744586098.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.3.dr	Binary or memory string: global block list test formVMware20,11696586537
Source: java.exe, 0000001D.00000003.1720769498.0000000014E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 0000001D.00000003.1720769498.0000000014E6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: Web Data.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696586537\|UE
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696586537]
Source: java.exe, 0000001D.00000002.1723486279.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: Web Data.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696586537d
Source: Web Data.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696586537}
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696586537p
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696586537z
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696586537n
Source: Web Data.3.dr	Binary or memory string: outlook.office.comVMware20,11696586537s
Source: javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe8
Source: Web Data.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696586537}
Source: Web Data.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696586537
Source: Web Data.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696586537^
Source: Web Data.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696586537x
Source: Web Data.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696586537~
Source: Web Data.3.dr	Binary or memory string: outlook.office365.comVMware20,11696586537t

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar"	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist.exe

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Code function: 29_2_028C03C0 cpuid

29_2_028C03C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\2176 VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4268 VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SVG Dropper

Source: Yara match

File source: Swift-TT680169 Report.svg, type: SAMPLE

Remote Access Functionality

Yara detected SVG Dropper

Source: Yara match

File source: Swift-TT680169 Report.svg, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://seasonmonster.s3.us-east-1.amazonaws.com/1.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/2.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/res.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/history.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/checker.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/email.js	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/3.jar	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com	0%	Avira URL Cloud	safe
https://branchlock.net8	0%	Avira URL Cloud	safe
https://seasonmonster.s3.us-east-1.amazonaws.com/recovery.jar	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.3.dr	false		high
http://crl.xrampsecurity.com/XGCA.crl	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Web Data.3.dr	false		high
http://crl.chambersign.org/chambersroot.crl0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://branchlock.net8	wscript.exe, 0000001B.00000003.1762756522.0000018ECE56B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.3.dr	false		high
https://repository.luxtrust.lu0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004EBC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bugreport.sun.com/bugreport/	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FBA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/2.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/	java.exe, 0000001D.00000002.1724509423.0000000004A00000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1750554499.0000000009FCA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/	javaw.exe, 00000021.00000002.1750554499.000000000A144000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1758258034.0000000015360000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.3.dr	false		high
http://repository.swisssign.com/0	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.3.dr	false		high
https://branchlock.net	Swift Confirmation Copy.jar.27.dr	false		high
http://policy.camerfirma.com	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/1.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/res.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://seasonmonster.s3.us-east-1.amazonaws.com/email.js	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://repository.luxtrust.lu	javaw.exe, 00000021.00000002.1747121169.0000000004EBC000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com	javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.xrampsecurity.com/XGCA.crl0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.3.dr	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/swiftcopy.pdf	javaw.exe, 00000021.00000002.1747121169.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/history.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersroot.crl	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	javaw.exe, 00000021.00000002.1747121169.0000000004BF2000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com0	javaw.exe, 00000021.00000002.1747121169.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://seasonmonster.s3.us-east-1.amazonaws.com/3.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://seasonmonster.s3.us-east-1.amazonaws.com/checker.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://seasonmonster.s3.us-east-1.amazonaws.com/recovery.jar	javaw.exe, 00000021.00000002.1750554499.000000000A05B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.1
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586628
Start date and time:	2025-01-09 12:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Swift-TT680169 Report.svg
Detection:	MAL
Classification:	mal88.troj.expl.evad.winSVG@73/174@0/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 79% Number of executed functions: 23 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .svg Internet access has been disabled

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, TextInputHost.exe
Execution Graph export aborted for target java.exe, PID 2176 because it is empty
Execution Graph export aborted for target javaw.exe, PID 4268 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:42:07	API Interceptor	43x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://lynxblog.net	Get hash	malicious	Unknown	Browse
	https://identity.thoughtspotlogin.cloud/	Get hash	malicious	HTMLPhisher	Browse
	https://booking.pathqerunknowns.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	colleague[1].htm	Get hash	malicious	Unknown	Browse
	http://hikingandadventures.com/inv/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse
	https://identity.login-authenticate.cloud/	Get hash	malicious	HTMLPhisher	Browse
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse
	https://www.nwocipuk.com/	Get hash	malicious	Unknown	Browse
	message__51fa7b20_1571_b6cf_e82f_a6f0e2bfa4a2_jamestraversgarage_ie_.eml	Get hash	malicious	Unknown	Browse
	http://s.viicxwec.com	Get hash	malicious	Unknown	Browse

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.964580823785508
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4US9apvn:oJ5bspvn
MD5:	CB328F2D3771A6E49BBB567EE2828854
SHA1:	B7E54DC56E0AD83F4598DDBE8AA3AF23C8894086
SHA-256:	D264A48FC502C4AEFED1FEDA772DDD4E9F24D9FD0F6984A6863004245C08E9AA
SHA-512:	EAC23968FB89480A3E802A956FE5A8696EE5FE4B670C1605E224DB6E2B5D0CA236708C4AA8EBBAC1C5D828897138C18B481DAB5E7D0D8501004628190DEFE727
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1736422959110..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03a8f6d2-06be-4efc-83cb-16948f075345.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65207
Entropy (8bit):	6.10437801589696
Encrypted:	false
SSDEEP:	1536:r/Ps+wsI7y0nS5nITaU90TpzZrEP+pa0YRvvfo9:r/0+zI7y0kgaWwppMfI
MD5:	60EFB64410AAB791D6EA413CA8313B34
SHA1:	2D89D7AB891854177BCCD876D12C8F7E4FECCC8C
SHA-256:	E5FEB462E17418076A197078B68E1AE81C0022C45233C4CAFC5F4DCF244FE217
SHA-512:	BBB5527C03873407E9F2A021D996D59E551C1D1BF533D71D85AE33758A19365AD3202B2FE5901E14FF131F6A160AA94679F8A4FEA4C8D185B27037D79A72A4BE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422948"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\143320e0-b762-4142-b33d-4e80c44a3ad4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b4f5d21-8126-4dd9-87bc-4a82e148cbe2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64311
Entropy (8bit):	6.1042543000224825
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7yOz5WITaU90TpzZrEP+pa0YRvvfog:y/0+zI7yOQgaWwppMfl
MD5:	BC9BAC45D6A647403246675DE57B4A16
SHA1:	DDD2DEA27733F999BEDD2988AF061AEF51588ED0
SHA-256:	F01F63FF129265E1A9B971DA3D71C8C8DE3C2D38C7CCC8228CC8B486D84F8214
SHA-512:	AAA8E21DD728EF2EECA75BA9C7D14169F53AFFEC036D624576617959835D7296200867A0B3E4D48563B1B377E57F2F1A814AC6F339999492EB6F71981055D667
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2a409780-63d2-495e-83f6-43ccf7f9f598.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65207
Entropy (8bit):	6.10438106604743
Encrypted:	false
SSDEEP:	1536:8/Ps+wsI7y04t5YITaU90TpzZrEP+pa0YRvvfo9:8/0+zI7y0xgaWwppMfI
MD5:	B28AFE132109F67411ABDE8B394D4D0F
SHA1:	56731F185652B715EA4F2DBD3EA0BCE3A3B5633E
SHA-256:	621F8F507688DE760014170F359EBC39AA9E1EEEAC786030A604C90E4EB8188E
SHA-512:	FCD1450FE11715974844BB97B51ED3D87760CC60E2942A51E434CC74C1AAC3EDD6E29489BAE37F931B939B42C5C1D465F3A339FFB201FA07863BBCA3EE415402
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736423001"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\566b605b-6868-45cb-aca8-3a1e411d05e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65130
Entropy (8bit):	6.104172078548004
Encrypted:	false
SSDEEP:	1536:J/Ps+wsI7yOnX5WITaU90TpzZrEP+pa0YRvvfo9:J/0+zI7yOsgaWwppMfI
MD5:	AC82B8DE713DDB0B9C046557483AEE67
SHA1:	1C8E990E6B15B6ED66B4B873823BED1756F31316
SHA-256:	441147CE19DB46E96150157778B2A47073FA94FB0F9DB0307B2C35FF22E31A09
SHA-512:	9992F547017AAEB64BFF151E0EDAE40C0A77ED345F1612BADAADE0A20A0E97CC01A38A31855C744D0E8D18C6F213F86711AABCF5A59129833C5118DC502DF678
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422920"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a16d7c6-47ac-4ed1-af29-259c6076f4de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FB5F0-188C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04638890904691548
Encrypted:	false
SSDEEP:	192:PZE90m5tmjnOAODYFJPi6VBK/72qtX3egIGYohvJNEQIzvS0RQc9zNXn8y08TcmQ:q90Ut0HYRFhxwpRzV08T2RGOD
MD5:	899F9370E0D8BB8F0F209BFB8C9549CF
SHA1:	44E7868894F057020378880BFEB8291FAF9858AD
SHA-256:	371FACC4282EAC569D914BDCC4EF8B6169F0B2F779CD9641D9BA6A8B55E72938
SHA-512:	8C251F308DF8D07ACA91BC46DE7D069B3FF9212B83187A1530B862F93F92FC2F032967EA97E9F6C0D1E324FE6C21C485BAF74E9EA8CB3E09F8ACB89C87CC62F0
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".cnrgqc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............."......................w..U.>.........."....."...24.."."JtyQ1A2NEIlw0A1806yiQy/yZBiHUYGocRJ4ref8zwc=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...f..a.. @..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FB5F1-1990.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.47863682031382787
Encrypted:	false
SSDEEP:	3072:0DXoUPpkm3fFwF9WUjXSdX4+Xx2jQ10qu291Rk04g1HFHfT7Yg1HF4GzTtHTm:AoU73NwB7SdXDxoqJ91R6aHVHYaH6Gp
MD5:	8354DD52DBB4C7378B4DD804405C78E2
SHA1:	66BB2493398271C2489F01BC95230BB3841D7E35
SHA-256:	3DF11449C85CA7224A79A4EFD29204FF0447FE1AB258CE067C4F75AD3D2A8B69
SHA-512:	5719200717354A8575681755AECE0448F1DB5C1FA980DE64BA344937E508B507F027E877D5BA47B436E7B2D86BDF3628713EBD0158162C704968B5E5B035C930
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".cnrgqc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............."......................w..U?:K..>.........."....."...24.."."JtyQ1A2NEIlw0A1806yiQy/yZBiHUYGocRJ4ref8zwc=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...f..a.. @..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.148816143243253
Encrypted:	false
SSDEEP:	3:FiWWltlySuHJcWlkddMc0cUdSPHllYBVP/Sh/JzvLGEuF5tIJ4QUH04ll:o1elqd0vdStWBVsJDyvDIJd20o
MD5:	615DE8EBA385564F4C7C695D15B15296
SHA1:	9881A42FECA4A67C63EDDDD191995C5D6F1347D9
SHA-256:	7ECF7405D8438F23D8373E87DAC39BA8963B2E8BEB94A6D57E526376ED7F54AE
SHA-512:	22AFBAD8CF3C20084584C8B207D66604994CF48C266761395DC474040E5C089D6FBD4AA852F75E3B89F1A300EE9BCB338FBF1D182CDB7831B7A90736AACC1258
Malicious:	false
Preview:	sdPC....................x.....RG..zl.!{'"JtyQ1A2NEIlw0A1806yiQy/yZBiHUYGocRJ4ref8zwc="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................2e0302ca-60d4-43ae-a7a2-15a4516f8209............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\086e0fa1-5907-4276-aeaa-8ee48f9b77af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\236d95c9-171c-419e-b9d6-06c58a9c63ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10592
Entropy (8bit):	5.067685830627677
Encrypted:	false
SSDEEP:	192:stgkdPscHtSMoI31kT3l8rbV+FiAVNwaIPetrJ:stgiscHYI3PbGiWNwa9
MD5:	F790E99D52EE289935476124E8E8CB2D
SHA1:	5C4C2FDA03A8384C25C70F69E048082361DAEC4F
SHA-256:	33B67E08EEBA992592D2DF148B8C9F7AE68013E801638FE5148B8F1A8FD15229
SHA-512:	5B9FA823E9097AC96270014E53942BDB4F26BC972D2E0173483009486EFF6E22755F9CFF0C1DCABAE2C1D9DBF01B6604B2873E358BE47B3D0AA70E409434635A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"collections":{"prism_collections":{"enabled":0,"policy":{"cached":2}},"rss_dev_feed":{"policy":{"cached":false}}},"con

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\26128592-a8ef-4943-bb36-46d9b02b808c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51705603-6cb4-4c1a-b73c-4cd7c444d23e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10427
Entropy (8bit):	5.068119302227428
Encrypted:	false
SSDEEP:	192:stgkdPscHtSMoI31kT3l8rbV+FiAVIaIPetrJ:stgiscHYI3PbGiWIa9
MD5:	8F0CA90F9ADAECDA6E6B312FB6F72305
SHA1:	E5BB4A7DB8E1935E2C8A0E6145E5CCB2720E6B53
SHA-256:	499509FE25AB898A93FF864194A0B79617EF695DFA26C00DD56ED43526AAB2F1
SHA-512:	4D3D63AC37A0E7D62680E3630E09EABF3DD9FD75E0C297F7FA42CA3C0686C26508A7EDD9A5A7F83C65823E2BBA614F3DD7530EC578359D75FA2900B3D87C69D2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"collections":{"prism_collections":{"enabled":0,"policy":{"cached":2}},"rss_dev_feed":{"policy":{"cached":false}}},"con

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53d0b431-60d0-44cc-99ab-831818e2dc12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10592
Entropy (8bit):	5.067836483361622
Encrypted:	false
SSDEEP:	192:stgkdYscHtSMoI31kT3l8rbV+FiATwaIPetrJ:stgZscHYI3PbGimwa9
MD5:	159C99E1B24C1973DDA1809CC51C64D8
SHA1:	2E23ACF1EA97921116D6F63B3952728D79FF7DC0
SHA-256:	F2577122AA004F3A0171CDDB143745FE8D5F0BDF918C2318BE7C88734DE5EB98
SHA-512:	C5E87180685358F3E62B0A47A5E59E7D9346C309F27F79621B796BC9825F3B238BE8A9E9A1637D2B20443700A96713930A18A5BDE91F35C6AC40F2D7F0ADE1FC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"collections":{"prism_collections":{"enabled":0,"policy":{"cached":2}},"rss_dev_feed":{"policy":{"cached":false}}},"con

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\671d9ce1-49dc-43ae-bb82-bbd67603ee2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10592
Entropy (8bit):	5.067772281214499
Encrypted:	false
SSDEEP:	192:stgkdKscHtSMoI31kT3l8rbV+FiAZwaIPetrJ:stg7scHYI3PbGi8wa9
MD5:	941935E7B3CF284E5A02043C4FAF2ECF
SHA1:	D05E7AFC10683723EF86853EBE48B9ACD418F299
SHA-256:	9A4C06C24B403AFC041AC5A3E021B9E4AC13FBEE630CB16E87FD3445DE69C5D0
SHA-512:	0C0B9B75B21A696A056D8AD92B8823F4D456B60117BF0D9D6DCA1FB5A6646F259C207EBCF14728DBDCB2B0055D18E1CEE9F605BEAEFA30525CA8D259877E470C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"collections":{"prism_collections":{"enabled":0,"policy":{"cached":2}},"rss_dev_feed":{"policy":{"cached":false}}},"con

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\78ec6223-0b73-4e17-a982-514a50997d28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5662145520229585
Encrypted:	false
SSDEEP:	768:z0Q0mdWPi0fAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvG+k7rwlpItuH:z0Q0mdWPi0fAbu1ja+rkQ0tQ
MD5:	BCF56D4428478A0852D2F6149D074F3B
SHA1:	A981C53C38189FD098607BF2DDDF736043B66D88
SHA-256:	67152765DBC4F1FD20EED016E68412C9862520172283B50A1F4D634C8D8BC47B
SHA-512:	06F72499CFD1BB7CAC4DC22C55A945E79AEF1B9C3782FE02A7B9098D613C038E3B88D358F66C59507909B4ED1ECAAFAA6C8FD5E0CEBA6298928CCAAF51F9771E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380896497445597","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380896497445597","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9312a82e-7afd-40f6-b844-5532437c5563.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.2285251424017245
Encrypted:	false
SSDEEP:	6:iOrB6LDB1sHO23oH+Tcwtp3hBtB2KLl5B6B9+q2PsHO23oH+Tcwtp3hBWsIFUv:7FgDAHVYebp3dFLJDvkHVYebp3eFUv
MD5:	7373C8618B9CDC019DCFDFAE0434CA06
SHA1:	5C131459EA36D798CC91995408702AC6A7CF8604
SHA-256:	8A3947593641FEAF3BD5C5F242BEEE33ED23753EFF956C7E81DD7BF334F32AE7
SHA-512:	0EF4292FBFBDC3B853F9D50BC2D23D7B8CCC465DC8978100F18FC61570A78DEDA77859951D23347577F63AC9D9361DB7809B2AC81DFFC4902E14C10B702C622D
Malicious:	false
Preview:	2025/01/09-06:41:40.178 1a48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/01/09-06:41:40.213 1a48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	336
Entropy (8bit):	5.104732273547424
Encrypted:	false
SSDEEP:	6:iOrB+fr4q2PsHO23oH+Tcwt9Eh1tIFUtJBYDJZmwPB13DkwOsHO23oH+Tcwt9Ehx:7FSr4vkHVYeb9Eh16FUtvYDJ/J9D51Hq
MD5:	F4DDD2C19023BDB76156BDFC88736D55
SHA1:	D69A7B4194138A4AF24948E9C68B14E5A6E5F8DB
SHA-256:	27D6940C041B2CCE4DB854AF0AE137B99C597D0844BB3C4935C7E0A32DA95E19
SHA-512:	8D0E0E17C27E023CEC268B727A62457CF1921CA95EA4AFFD70890258145BB0AE86689AF64C5FC550D49D28092E1B102325BF6173096A0463D7C9C788BF9EAA43
Malicious:	false
Preview:	2025/01/09-06:41:40.071 1cb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/09-06:41:40.073 1cb4 Recovering log #3.2025/01/09-06:41:40.139 1cb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.104732273547424
Encrypted:	false
SSDEEP:	6:iOrB+fr4q2PsHO23oH+Tcwt9Eh1tIFUtJBYDJZmwPB13DkwOsHO23oH+Tcwt9Ehx:7FSr4vkHVYeb9Eh16FUtvYDJ/J9D51Hq
MD5:	F4DDD2C19023BDB76156BDFC88736D55
SHA1:	D69A7B4194138A4AF24948E9C68B14E5A6E5F8DB
SHA-256:	27D6940C041B2CCE4DB854AF0AE137B99C597D0844BB3C4935C7E0A32DA95E19
SHA-512:	8D0E0E17C27E023CEC268B727A62457CF1921CA95EA4AFFD70890258145BB0AE86689AF64C5FC550D49D28092E1B102325BF6173096A0463D7C9C788BF9EAA43
Malicious:	false
Preview:	2025/01/09-06:41:40.071 1cb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/09-06:41:40.073 1cb4 Recovering log #3.2025/01/09-06:41:40.139 1cb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 34, database pages 18, cookie 0x19, schema 4, UTF-8, version-valid-for 34
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.4947385728088827
Encrypted:	false
SSDEEP:	96:xR94jweGq2L4H7pgNPdQyoDbel9myJrDVb4:f94ZBS4FgNPdPl9myRDVb4
MD5:	29C9AF42D59BA452C914D337F83778D8
SHA1:	0D4075E73B0189BD28D6968499DCFDE5975116CB
SHA-256:	DFDAE22D17235546DAF4200A5920C46B10E0885D9A0BE747D3DE14F432817613
SHA-512:	DB03C53D1CC2AE5E1E7882437730454AC27842FE5211A6DBDBBB5131EB0D607DB5D2F26EADB08CD9BAD90FD93D6E04A2C27361FE5BD1B510467D2E9BAEF90FBE
Malicious:	false
Preview:	SQLite format 3......@ ..."..................................................................."..j....................0...{...h.6.~.%...U........................................................................................................................................................................................................................................................................................................................................................................G...##..Utablecollectionscollections.CREATE TABLE collections ( id LONGVARCHAR PRIMARY KEY, date_created REAL NOT NULL, date_modified REAL NOT NULL, title LONGVARCHAR NOT NULL, position INTEGER NOT NULL, is_syncable INTEGER DEFAULT 1, suggestion_url LONGVARCHAR, suggestion_dismissed INTEGER, suggestion_type INTEGER, thumbnail BLOB, is_custom_thumbnail INTEGER NOT NULL DEFAULT 0, tag LONGVARCHAR, thumbnail_url LONGVARCHAR, is_marked_for_deletion INTEGER)..........tableitemsitems.CREATE TABLE items

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.43508159006069336
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBI:TouQq3qh7z3bY2LNW9WMcUvB
MD5:	F5237AED0F897E7619A94843845A3EC3
SHA1:	A0C752C9C28A753CFB051AACE2ADA78A6D1288C3
SHA-256:	D4463972AD7B1582F05C8E17074CE863D45CA625C2C672DB0D37F3AF4C7ACE42
SHA-512:	D3C9718794E455D415D8EDF23B576E0A70356B8D71B8DD374D25B8065FEF608E114E13395B4B54462739882A141F4DBE00E3A370D6E4160504428A849CC893A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlIa7:Ls3n
MD5:	AEA179F04C1F4CB821E3BA6D7A70D64D
SHA1:	EE26B584FD067BE9C7C1873F3461F2916C8D077F
SHA-256:	501541A6A9131FF5FCE05A021736269C7611EA4BF529019D522E2869329C601B
SHA-512:	2AFB414BB4D046280F2FC68F7CA8B724EEF4C28FAE6E7756BE2D0E0D187C7EE22D7ED82B34A76D9D0ED2FE8AE0BD52C56FF9487B592F6D0193C327D894E9F62D
Malicious:	false
Preview:	........................................Ss{../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	4.8493488566764755
Encrypted:	false
SSDEEP:	12:TJD8MD/QJVS4W0TodDfMD/QJVQdh/m0T9DkMD/QJVL50T3D1gtMD/QJVTG0Td:TJD8I/oVS4W0TodDw/oVmm0T9DkI/oVj
MD5:	A00BFE53430F09351C2E968DF02E7208
SHA1:	76A205D2AEBF3CA9A5477C35726E81A040BCB865
SHA-256:	61C8753160CE9B1466E0910088E41C4A2AAB1A87AA09D4C57F5BD8AE6C50B421
SHA-512:	69299A7809A7564960D8EB259F9571B6D8476A7B42ADEDB42DFA8282D33F0920D0DC7576E72E29B5060B1E8709C8CD5D30237AD16F0C0C632151A2FA63F222FF
Malicious:	false
Preview:	...m.................DB_VERSION.1.+3`.................BLOOM_FILTER:..Y..9................BLOOM_FILTER_EXPIRY_TIME:.1736509314.726270....................BLOOM_FILTER_LAST_MODIFIED:..l...................BLOOM_FILTER:..{..9................BLOOM_FILTER_EXPIRY_TIME:.1736509316.633508@y.2................BLOOM_FILTER_LAST_MODIFIED:.G.+8.................BLOOM_FILTER:.....9................BLOOM_FILTER_EXPIRY_TIME:.1736509343.5352338.%.................BLOOM_FILTER_LAST_MODIFIED:...u..................BLOOM_FILTER:....9................BLOOM_FILTER_EXPIRY_TIME:.1736509396.739190t/.3................BLOOM_FILTER_LAST_MODIFIED:.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2057737736667775
Encrypted:	false
SSDEEP:	6:iOrBXslEKq2PsHO23oH+TcwtnG2tMsIFUtJBXsXuIFZZmwPBXsXuIFzkwOsHO23p:7F8lZvkHVYebn9GFUtv8v/J8951HVYeV
MD5:	9A741AEF84AFB25E0EDE62A90A315F9C
SHA1:	3BA4CCB214CD4F7A8BD436A4EC53C7D351428E6B
SHA-256:	23CFA6A37FC1746BE648ADEE607A092C77B3CA26A8BC3DFB4E95DB841545CE21
SHA-512:	D477CFECD4DC46EB0AFA5BE6F6B9231FAFDCFB3EB14918F6A918D955FAA00E58EF622EF4107BBE06BCBBEEABCF3887141215220C37D4DA6E9165BEAF01AC0EC6
Malicious:	false
Preview:	2025/01/09-06:41:37.481 1ad0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/09-06:41:37.482 1ad0 Recovering log #3.2025/01/09-06:41:37.482 1ad0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2057737736667775
Encrypted:	false
SSDEEP:	6:iOrBXslEKq2PsHO23oH+TcwtnG2tMsIFUtJBXsXuIFZZmwPBXsXuIFzkwOsHO23p:7F8lZvkHVYebn9GFUtv8v/J8951HVYeV
MD5:	9A741AEF84AFB25E0EDE62A90A315F9C
SHA1:	3BA4CCB214CD4F7A8BD436A4EC53C7D351428E6B
SHA-256:	23CFA6A37FC1746BE648ADEE607A092C77B3CA26A8BC3DFB4E95DB841545CE21
SHA-512:	D477CFECD4DC46EB0AFA5BE6F6B9231FAFDCFB3EB14918F6A918D955FAA00E58EF622EF4107BBE06BCBBEEABCF3887141215220C37D4DA6E9165BEAF01AC0EC6
Malicious:	false
Preview:	2025/01/09-06:41:37.481 1ad0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/01/09-06:41:37.482 1ad0 Recovering log #3.2025/01/09-06:41:37.482 1ad0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.119274960362934
Encrypted:	false
SSDEEP:	6:iOrBx/n34M1sHO23oH+Tcwtk2WwnvB2KLl5B1HUWMq2PsHO23oH+Tcwtk2WwnvIg:7Fxf34rHVYebkxwnvFLJ10jvkHVYebk8
MD5:	0629484D88994CB4B11B9AC5BAC9A43D
SHA1:	5A9FAE88B354E18CA3BD6CAECC4AD12E10D90198
SHA-256:	1442E44BEA9CD00500593446501831A586AF928AB3571FC4F31F83C3D53DA0A0
SHA-512:	0569C91DFFF7B187254E762460253917E694267588717D93496670231DE400C40AE3EA6A746D53AE715A54868B77355A886D8ACC54793CB02333AB47A38F5683
Malicious:	false
Preview:	2025/01/09-06:41:40.108 1cd4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/09-06:41:40.148 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.178098240880329
Encrypted:	false
SSDEEP:	6:iOrBXUG3+q2PsHO23oH+Tcwt8aPrqIFUtJBXGGXWZmwPBXGGiVkwOsHO23oH+TcD:7Fv+vkHVYebL3FUtvBW/JcV51HVYebQJ
MD5:	B31226F74F3C3C41D2F3447C526495EA
SHA1:	C486803A7245BE5AD7674365936B7112DE5BE1D0
SHA-256:	048012A331057BC3CBCF6FE7319E3218714FF0F8C546FD74E43BCC73E265F36A
SHA-512:	94834160621E2B5E022CB5D889235B5A960A2C994286204C276B0D91D724BA614FF9704AA41CDCE9E7625FC33396A1ED88E2D770B2F1888DEE94D38115FC3B48
Malicious:	false
Preview:	2025/01/09-06:41:37.474 1acc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/09-06:41:37.475 1acc Recovering log #3.2025/01/09-06:41:37.475 1acc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.178098240880329
Encrypted:	false
SSDEEP:	6:iOrBXUG3+q2PsHO23oH+Tcwt8aPrqIFUtJBXGGXWZmwPBXGGiVkwOsHO23oH+TcD:7Fv+vkHVYebL3FUtvBW/JcV51HVYebQJ
MD5:	B31226F74F3C3C41D2F3447C526495EA
SHA1:	C486803A7245BE5AD7674365936B7112DE5BE1D0
SHA-256:	048012A331057BC3CBCF6FE7319E3218714FF0F8C546FD74E43BCC73E265F36A
SHA-512:	94834160621E2B5E022CB5D889235B5A960A2C994286204C276B0D91D724BA614FF9704AA41CDCE9E7625FC33396A1ED88E2D770B2F1888DEE94D38115FC3B48
Malicious:	false
Preview:	2025/01/09-06:41:37.474 1acc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/01/09-06:41:37.475 1acc Recovering log #3.2025/01/09-06:41:37.475 1acc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181809667696067
Encrypted:	false
SSDEEP:	6:iOrBXO+q2PsHO23oH+Tcwt865IFUtJBXbAWZmwPBXb3VkwOsHO23oH+Tcwt86+Ud:7F++vkHVYeb/WFUtvrAW/Jr3V51HVYev
MD5:	C6311CB42DE00C708730844AC0BDF4AD
SHA1:	CDECB9DD723A7E4E1FD6AEE2975E97CC75F3676D
SHA-256:	FDF58F8E47184D8B7B8C29B7DC9366504F85A8587EB5D00DD55A273279D299C6
SHA-512:	A23461D495245E98CFF5C9357DB5DB64B82B12E6B6D2A7047457AD7E0834E93B037F0A7ED7EC22F0BB36AC3E80DCE968CF2DC108651AE2BC5C559742875EECFA
Malicious:	false
Preview:	2025/01/09-06:41:37.495 1acc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/09-06:41:37.496 1acc Recovering log #3.2025/01/09-06:41:37.496 1acc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181809667696067
Encrypted:	false
SSDEEP:	6:iOrBXO+q2PsHO23oH+Tcwt865IFUtJBXbAWZmwPBXb3VkwOsHO23oH+Tcwt86+Ud:7F++vkHVYeb/WFUtvrAW/Jr3V51HVYev
MD5:	C6311CB42DE00C708730844AC0BDF4AD
SHA1:	CDECB9DD723A7E4E1FD6AEE2975E97CC75F3676D
SHA-256:	FDF58F8E47184D8B7B8C29B7DC9366504F85A8587EB5D00DD55A273279D299C6
SHA-512:	A23461D495245E98CFF5C9357DB5DB64B82B12E6B6D2A7047457AD7E0834E93B037F0A7ED7EC22F0BB36AC3E80DCE968CF2DC108651AE2BC5C559742875EECFA
Malicious:	false
Preview:	2025/01/09-06:41:37.495 1acc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/01/09-06:41:37.496 1acc Recovering log #3.2025/01/09-06:41:37.496 1acc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1512596061888125
Encrypted:	false
SSDEEP:	6:iOrBXPSq2PsHO23oH+Tcwt8NIFUtJBXqU0ZZmwPBXqU0zkwOsHO23oH+Tcwt8+ed:7FfSvkHVYebpFUtvMZ/JMz51HVYebqJ
MD5:	1E2EC7AF4F613F3CCCD6FF2FFFC245E9
SHA1:	2C3532D0846DCFABEE554A9BA9F0CF84EE0D2037
SHA-256:	595F98EC9F448109A6A23406A30603D8B1F1FBFB00F2AFF5474D51A5688D03A8
SHA-512:	836CA54EC05CAC7B7CE8A1361F16AD2E6ACE6E4964668D3CFC7D94F6046A6B2EE0A58B0F66460779809EC35607BAE53D000EE4D0E9F827EA9A62CFC28FFFEFEB
Malicious:	false
Preview:	2025/01/09-06:41:38.084 1a44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/09-06:41:38.085 1a44 Recovering log #3.2025/01/09-06:41:38.085 1a44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1512596061888125
Encrypted:	false
SSDEEP:	6:iOrBXPSq2PsHO23oH+Tcwt8NIFUtJBXqU0ZZmwPBXqU0zkwOsHO23oH+Tcwt8+ed:7FfSvkHVYebpFUtvMZ/JMz51HVYebqJ
MD5:	1E2EC7AF4F613F3CCCD6FF2FFFC245E9
SHA1:	2C3532D0846DCFABEE554A9BA9F0CF84EE0D2037
SHA-256:	595F98EC9F448109A6A23406A30603D8B1F1FBFB00F2AFF5474D51A5688D03A8
SHA-512:	836CA54EC05CAC7B7CE8A1361F16AD2E6ACE6E4964668D3CFC7D94F6046A6B2EE0A58B0F66460779809EC35607BAE53D000EE4D0E9F827EA9A62CFC28FFFEFEB
Malicious:	false
Preview:	2025/01/09-06:41:38.084 1a44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/01/09-06:41:38.085 1a44 Recovering log #3.2025/01/09-06:41:38.085 1a44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlzf0r:Ls3z
MD5:	D404EB283C490459808CB27651538AA3
SHA1:	C34C908001E95F03CE902FC1B6A8184A653ED315
SHA-256:	0BB71BAA14EAEE3E3FDC5B86473E06F70136DB8C54F9B20F19A66D7182DAA213
SHA-512:	3A6B15F27837822BE761AAA5D6737E2E30D84B1430C8CAA6C7016CE7ED0B9F38D255C10EA16B5436EECC06277227F9A037518E1EF7700C89ED10FFC8BA11A466
Malicious:	false
Preview:	........................................;.z../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.85474119255062
Encrypted:	false
SSDEEP:	192:mmnYe+me+me+9hH+bDo3iN0Z2TVJkXBBE3ybo:msYe+me+me+9hIU3iGAIBBE3qo
MD5:	2B3676EB7490908A56D4FACF4C71EB23
SHA1:	6F4A784E3EB1A310C7EB0437CFAAAFE0CAB7BD71
SHA-256:	E81E1070924B8F7499ED99C12948F54E64889DC1D9FB89CBD50C4C3ABBE28EB7
SHA-512:	614E5BDC28794AD20750603504A470C4C0E52F2B5174D4D68CA5782972E7BF0C917E728910438CE7664A66D6FC9FA54E9EF6328EB011C8AAEC503A7B2C001CBE
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.279164698842236
Encrypted:	false
SSDEEP:	12:7FyvkHVYeb8rcHEZrELFUtv7/JR51HVYeb8rcHEZrEZSJ:7FYk1Yeb8nZrExgv9D11Yeb8nZrEZe
MD5:	4DC46E6A4DA72AB3410E8D29CF20751D
SHA1:	F41B3BE9ADD5A970749859F0478EB960D56D509E
SHA-256:	6BF85468753A281CDE086EC55D4ADB61DC09A908A041157081C6C133FB265C99
SHA-512:	8EEEF1D864B5B5B5BE2A41E0A01AFF1AD6503BCB9DF89F6FB606B4780FCC6A356CC3137423027B130B8C57162B192483C7789CB5044581F44F34D489E3A2EBCC
Malicious:	false
Preview:	2025/01/09-06:41:38.941 1a44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/09-06:41:38.941 1a44 Recovering log #3.2025/01/09-06:41:38.941 1a44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.279164698842236
Encrypted:	false
SSDEEP:	12:7FyvkHVYeb8rcHEZrELFUtv7/JR51HVYeb8rcHEZrEZSJ:7FYk1Yeb8nZrExgv9D11Yeb8nZrEZe
MD5:	4DC46E6A4DA72AB3410E8D29CF20751D
SHA1:	F41B3BE9ADD5A970749859F0478EB960D56D509E
SHA-256:	6BF85468753A281CDE086EC55D4ADB61DC09A908A041157081C6C133FB265C99
SHA-512:	8EEEF1D864B5B5B5BE2A41E0A01AFF1AD6503BCB9DF89F6FB606B4780FCC6A356CC3137423027B130B8C57162B192483C7789CB5044581F44F34D489E3A2EBCC
Malicious:	false
Preview:	2025/01/09-06:41:38.941 1a44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/01/09-06:41:38.941 1a44 Recovering log #3.2025/01/09-06:41:38.941 1a44 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153298252477235
Encrypted:	false
SSDEEP:	6:iOrBXOEQyq2PsHO23oH+Tcwt8a2jMGIFUtJBX0UHUYG1ZmwPBXfQRkwOsHO23oHr:7FbQyvkHVYeb8EFUtvkU0Yg/JvQR51Hy
MD5:	FB9926A4D82EC946C6BFC334AC3EA796
SHA1:	279DB92A05D29A704F5C0C7F9274AFEE06ACE1D9
SHA-256:	6296BBCEA07EE0476CDF5D83706163B75799AB9F7A41AAC090BC05C234D53D31
SHA-512:	E0C1B288583448C61A9C20DEE0131182DCCDEA64C460E395F223E5326964C80CBDB13518F42D4FE419EE48132D6E8A2917B2B07F66048363C2EB70AFD1AB76CB
Malicious:	false
Preview:	2025/01/09-06:41:37.543 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/09-06:41:37.545 1b10 Recovering log #3.2025/01/09-06:41:37.550 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153298252477235
Encrypted:	false
SSDEEP:	6:iOrBXOEQyq2PsHO23oH+Tcwt8a2jMGIFUtJBX0UHUYG1ZmwPBXfQRkwOsHO23oHr:7FbQyvkHVYeb8EFUtvkU0Yg/JvQR51Hy
MD5:	FB9926A4D82EC946C6BFC334AC3EA796
SHA1:	279DB92A05D29A704F5C0C7F9274AFEE06ACE1D9
SHA-256:	6296BBCEA07EE0476CDF5D83706163B75799AB9F7A41AAC090BC05C234D53D31
SHA-512:	E0C1B288583448C61A9C20DEE0131182DCCDEA64C460E395F223E5326964C80CBDB13518F42D4FE419EE48132D6E8A2917B2B07F66048363C2EB70AFD1AB76CB
Malicious:	false
Preview:	2025/01/09-06:41:37.543 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/01/09-06:41:37.545 1b10 Recovering log #3.2025/01/09-06:41:37.550 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b58d6c0-6ed0-4b08-9344-e7c108eaa90a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF1b800.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Token Bindings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	20480
Entropy (8bit):	0.4716248163409303
Encrypted:	false
SSDEEP:	24:TLYcfCNWbgZFORkq6cMfPmh0E6UwccI5fB:TeWbgZFORKPXU1cEB
MD5:	72E9D82D6C1742197EEA43EC203C6825
SHA1:	275AE552E437747FD707962111675AA2C8DEEB0F
SHA-256:	0DB0BA239E0421208146C4FBB809F2DBD960019FE4F4EC4CBC894C29627DD759
SHA-512:	C62C7C0C9BBE1CFAE2FEF39FBDF70BB5316713D87453096676BD854A19FDD8BC62F1608F8BE3602AD8770B94C13FFE5A9516F05A95548615CB78ED9CEADC7EA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......q..g...q.0....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7987d00-222b-4b22-962a-b98eabaa8eb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0a6b059-8a02-496f-97a1-bc629f8fa1d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd000c53-5fe7-48de-9c31-3ff42621b825.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF20bae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF24df7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF28bdb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2c336.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35bbd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	5.076539807323415
Encrypted:	false
SSDEEP:	192:stgkd9sgHtSMoI31kT3l88bV+FiAHdaIPecEJ:stgysgHYI3QbGiUdaj
MD5:	E391D57C766A60512A532175F41C151D
SHA1:	65A49BFA99B62274B47DBE9BEC12C447C89B6D54
SHA-256:	61EF8A3BFE55A1C595E08DF7FFDA326F946387182E3472DF1F6EE04D8D7CCB26
SHA-512:	5FCD2DB9F434BBEED2F04091D703C3E85D25270B5189A04B59D242449863BF7D7E6E920F6D5FE90BBBF31675A633D086D2FFE5A0E0494B1E16D2E14ED1DE8488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5662145520229585
Encrypted:	false
SSDEEP:	768:z0Q0mdWPi0fAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvG+k7rwlpItuH:z0Q0mdWPi0fAbu1ja+rkQ0tQ
MD5:	BCF56D4428478A0852D2F6149D074F3B
SHA1:	A981C53C38189FD098607BF2DDDF736043B66D88
SHA-256:	67152765DBC4F1FD20EED016E68412C9862520172283B50A1F4D634C8D8BC47B
SHA-512:	06F72499CFD1BB7CAC4DC22C55A945E79AEF1B9C3782FE02A7B9098D613C038E3B88D358F66C59507909B4ED1ECAAFAA6C8FD5E0CEBA6298928CCAAF51F9771E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380896497445597","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380896497445597","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF218ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.5662145520229585
Encrypted:	false
SSDEEP:	768:z0Q0mdWPi0fAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvG+k7rwlpItuH:z0Q0mdWPi0fAbu1ja+rkQ0tQ
MD5:	BCF56D4428478A0852D2F6149D074F3B
SHA1:	A981C53C38189FD098607BF2DDDF736043B66D88
SHA-256:	67152765DBC4F1FD20EED016E68412C9862520172283B50A1F4D634C8D8BC47B
SHA-512:	06F72499CFD1BB7CAC4DC22C55A945E79AEF1B9C3782FE02A7B9098D613C038E3B88D358F66C59507909B4ED1ECAAFAA6C8FD5E0CEBA6298928CCAAF51F9771E
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380896497445597","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380896497445597","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270
Entropy (8bit):	2.627204731507878
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljljljl:S85aEFljljljljljljljljljljljl
MD5:	70EF71DD0FED6C14B2B6E149267A2C2A
SHA1:	B8829EA9631CD5E0ABA87D81E71047EF5FA92F24
SHA-256:	3530055A62DDC24A89DD97751AC9DB187D009EB8193A29A3636CAE2567D4A4CD
SHA-512:	2ED43127BCD5443C4CD04A01F70DE06C50FCEF1F284EE4DFEC07E605133AA5CD6A1E197DBC0C6E73679AF491B976A7304E8D38D58C948CB55471399978470241
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.164934024739058
Encrypted:	false
SSDEEP:	6:iOrBXIvU/Qyq2PsHO23oH+TcwtrQMxIFUtJBXIVEG1ZmwPBXe2QRkwOsHO23oH+L:7FYvEQyvkHVYebCFUtvYmg/Ju2QR51H9
MD5:	88DF378522C0C28BE9626D4A6727798C
SHA1:	04B5E78DDF30BBC01EEE9078355E6B612ACB332D
SHA-256:	02DB0A5D78610DD6523994A9AEDF4FA5F1C1113A9A1DA443A5B75293B7ABB96B
SHA-512:	641EF64EFD4FCDE2FA1FBDF851A5F05300754A0CC332797881A18C86676EBFB4A1BE18136D59D3738AAC1CE2D0E6B3CB7AF1930D328AB359588DD6096ED3416E
Malicious:	false
Preview:	2025/01/09-06:41:37.880 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/09-06:41:37.882 1b10 Recovering log #3.2025/01/09-06:41:37.895 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.164934024739058
Encrypted:	false
SSDEEP:	6:iOrBXIvU/Qyq2PsHO23oH+TcwtrQMxIFUtJBXIVEG1ZmwPBXe2QRkwOsHO23oH+L:7FYvEQyvkHVYebCFUtvYmg/Ju2QR51H9
MD5:	88DF378522C0C28BE9626D4A6727798C
SHA1:	04B5E78DDF30BBC01EEE9078355E6B612ACB332D
SHA-256:	02DB0A5D78610DD6523994A9AEDF4FA5F1C1113A9A1DA443A5B75293B7ABB96B
SHA-512:	641EF64EFD4FCDE2FA1FBDF851A5F05300754A0CC332797881A18C86676EBFB4A1BE18136D59D3738AAC1CE2D0E6B3CB7AF1930D328AB359588DD6096ED3416E
Malicious:	false
Preview:	2025/01/09-06:41:37.880 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/01/09-06:41:37.882 1b10 Recovering log #3.2025/01/09-06:41:37.895 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13380896499942978

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4119
Entropy (8bit):	3.507561955873476
Encrypted:	false
SSDEEP:	48:3MOINBbx44ajew15yH7ZqV3B8/KyYxv8MJhlgkK0U7A:3Mz45esO9g8/C9BFUc
MD5:	4DB5F4DDAF515AC4995FDF792AD0ECCC
SHA1:	6EDA61655E96B22CBE6385068DE32E6ADFC2FDE6
SHA-256:	D7E264AF0B32EF40DF71035BFB01A6F071E93DBFDCCE85F10579758A5D648C61
SHA-512:	E626A91EFDC9442B2376BC31F5F11F9E01E654FAF8E5C9B73618075022548C9A93FC06F8C87819CFAA7DDB2846A892B27D57AC292170253A75FD9AB92F234DF6
Malicious:	false
Preview:	SNSS........#..............#........".#..............#..........#..........#..........#......!...#..................................#...#..1..,....#..$...28b9cc93_8ead_408e_a708_a6fe658baf43....#..........#......S..........#......#..........................#..........................#..............#......;...file:///C:/Users/user/Desktop/Swift-TT680169%20Report.svg.............!..........................................................................................................vD+.....vD+..H.......`...............X.......................................................~...;...f.i.l.e.:./././.C.:./.U.s.e.r.s./.t.o.r.r.e.s./.D.e.s.k.t.o.p./.S.w.i.f.t.-.T.T.6.8.0.1.6.9.%.2.0.R.e.p.o.r.t...s.v.g...................................8.......0.......8....................................................................... .......................................................P...$...2.8.2.d.1.c.a.6.-.4.d.e.9.-.4.6.9.4.-.8.1.d.0.-.4.f.6.c.3.3.e.9.2.d.a.0.................P...$...a.f.7.e.b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.140705535491964
Encrypted:	false
SSDEEP:	6:iOrBX2+q2PsHO23oH+Tcwt7Uh2ghZIFUtJBXtZmwPBXxVkwOsHO23oH+Tcwt7Uh9:7FG+vkHVYebIhHh2FUtv9/JBV51HVYeQ
MD5:	5278458014C82A98F6C36C74919BBA00
SHA1:	2D7895FD63B47A8B15614119F7F1BB715C75E560
SHA-256:	5874CA641B5BE8ECC59E378F8A7A28082B94BAE287222599D38E6073C5AC991F
SHA-512:	8E859E4227B653AA03938CF9FDAE48D5E5A5226DF8F2589B23FEF5C40F436CD6772CB6043EBCDF26658CF30305B564B211CA2B8B9DF931D81E877531094F7712
Malicious:	false
Preview:	2025/01/09-06:41:37.438 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/09-06:41:37.439 1a4c Recovering log #3.2025/01/09-06:41:37.439 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.140705535491964
Encrypted:	false
SSDEEP:	6:iOrBX2+q2PsHO23oH+Tcwt7Uh2ghZIFUtJBXtZmwPBXxVkwOsHO23oH+Tcwt7Uh9:7FG+vkHVYebIhHh2FUtv9/JBV51HVYeQ
MD5:	5278458014C82A98F6C36C74919BBA00
SHA1:	2D7895FD63B47A8B15614119F7F1BB715C75E560
SHA-256:	5874CA641B5BE8ECC59E378F8A7A28082B94BAE287222599D38E6073C5AC991F
SHA-512:	8E859E4227B653AA03938CF9FDAE48D5E5A5226DF8F2589B23FEF5C40F436CD6772CB6043EBCDF26658CF30305B564B211CA2B8B9DF931D81E877531094F7712
Malicious:	false
Preview:	2025/01/09-06:41:37.438 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/01/09-06:41:37.439 1a4c Recovering log #3.2025/01/09-06:41:37.439 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.217727648657573
Encrypted:	false
SSDEEP:	12:7FxQyvkHVYebvqBQFUtv4g/JFsSQR51HVYebvqBvJ:7Fx5k1YebvZgv4cFsSS11Yebvk
MD5:	C8F4099EB1BA61947232D53FA590A736
SHA1:	A16FBB178105B5D726FFD2DDC23DF5939175B199
SHA-256:	6630EAB69BC5615F2EC64A80C9661C20B09F5322C5A7D2FB4A3D47C13C3A023A
SHA-512:	B43D5152E2BA50530F826008A83CB186ED179542A4095D69B81FDF2091F69791D1BD9EFFDC0A664CA6C2FB5D2A907C6AFFFB2780BA535430C6DCA45F4520C7F1
Malicious:	false
Preview:	2025/01/09-06:41:38.054 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/09-06:41:38.055 1b10 Recovering log #3.2025/01/09-06:41:38.061 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.217727648657573
Encrypted:	false
SSDEEP:	12:7FxQyvkHVYebvqBQFUtv4g/JFsSQR51HVYebvqBvJ:7Fx5k1YebvZgv4cFsSS11Yebvk
MD5:	C8F4099EB1BA61947232D53FA590A736
SHA1:	A16FBB178105B5D726FFD2DDC23DF5939175B199
SHA-256:	6630EAB69BC5615F2EC64A80C9661C20B09F5322C5A7D2FB4A3D47C13C3A023A
SHA-512:	B43D5152E2BA50530F826008A83CB186ED179542A4095D69B81FDF2091F69791D1BD9EFFDC0A664CA6C2FB5D2A907C6AFFFB2780BA535430C6DCA45F4520C7F1
Malicious:	false
Preview:	2025/01/09-06:41:38.054 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/01/09-06:41:38.055 1b10 Recovering log #3.2025/01/09-06:41:38.061 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\868fe323-762d-4b97-805b-2c44250186c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8d2eb237-e21c-42c0-9cef-b083559c6cf1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.241763129263191
Encrypted:	false
SSDEEP:	12:7FRx/QyvkHVYebvqBZFUtvRmFLYg/JRsQR51HVYebvqBaJ:7FRx/5k1YebvygvRm2cRsS11YebvL
MD5:	1A11E8A8897B3DB927F9F2C4A228B9A2
SHA1:	92AAA4AD7E2ACAE1E61CEFE01D396406FC3F7ABE
SHA-256:	3613B8E45DAAB9FC43ECDBA3B3EE1DCB80E241CEF9E09AADC455E45D4084B202
SHA-512:	3893473954E6A40F1B827228E8738EDC00C9FD739ABE46593F64A718E7E8F6E693236155089C0AFFFC489A8E047ACE87B3EE6685E8BF6B33844C13F2FBC11E2D
Malicious:	false
Preview:	2025/01/09-06:41:53.822 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/09-06:41:53.824 1b10 Recovering log #3.2025/01/09-06:41:53.827 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.241763129263191
Encrypted:	false
SSDEEP:	12:7FRx/QyvkHVYebvqBZFUtvRmFLYg/JRsQR51HVYebvqBaJ:7FRx/5k1YebvygvRm2cRsS11YebvL
MD5:	1A11E8A8897B3DB927F9F2C4A228B9A2
SHA1:	92AAA4AD7E2ACAE1E61CEFE01D396406FC3F7ABE
SHA-256:	3613B8E45DAAB9FC43ECDBA3B3EE1DCB80E241CEF9E09AADC455E45D4084B202
SHA-512:	3893473954E6A40F1B827228E8738EDC00C9FD739ABE46593F64A718E7E8F6E693236155089C0AFFFC489A8E047ACE87B3EE6685E8BF6B33844C13F2FBC11E2D
Malicious:	false
Preview:	2025/01/09-06:41:53.822 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/01/09-06:41:53.824 1b10 Recovering log #3.2025/01/09-06:41:53.827 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.225720459659531
Encrypted:	false
SSDEEP:	6:iOrBX04q2PsHO23oH+TcwtpIFUtJBX0JZmwPBXJDkwOsHO23oH+Tcwta/WLJ:7FTvkHVYebmFUtvG/JJ51HVYebaUJ
MD5:	2AECF5B82923D8DCC2226D9467EDBCB6
SHA1:	F3D63B574B8DD802441E44A966E7B388AFA33C2B
SHA-256:	775A8AB95130C345724CA6390C0491418C645837196144D0524C40B5ACE20093
SHA-512:	521A7F4BB490FDA826D53EA3E771D93E68F252F36C8E37D843AFB30FCB35A6CFCA2BC11052C590FD1322553D4E945E1E9C4A591527BEED6E0F84B9DE0B1B2343
Malicious:	false
Preview:	2025/01/09-06:41:37.471 1a84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/09-06:41:37.471 1a84 Recovering log #3.2025/01/09-06:41:37.472 1a84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.225720459659531
Encrypted:	false
SSDEEP:	6:iOrBX04q2PsHO23oH+TcwtpIFUtJBX0JZmwPBXJDkwOsHO23oH+Tcwta/WLJ:7FTvkHVYebmFUtvG/JJ51HVYebaUJ
MD5:	2AECF5B82923D8DCC2226D9467EDBCB6
SHA1:	F3D63B574B8DD802441E44A966E7B388AFA33C2B
SHA-256:	775A8AB95130C345724CA6390C0491418C645837196144D0524C40B5ACE20093
SHA-512:	521A7F4BB490FDA826D53EA3E771D93E68F252F36C8E37D843AFB30FCB35A6CFCA2BC11052C590FD1322553D4E945E1E9C4A591527BEED6E0F84B9DE0B1B2343
Malicious:	false
Preview:	2025/01/09-06:41:37.471 1a84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/01/09-06:41:37.471 1a84 Recovering log #3.2025/01/09-06:41:37.472 1a84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033769341339387224
Encrypted:	false
SSDEEP:	3:ImtVuCqo6PXsoOllll/:IiVuCqDEoOll
MD5:	185F06FD3A2A15FA57697C1F631A9A03
SHA1:	F5D875C8FC2787885E69DDC276976E2F755293DC
SHA-256:	C0DEBC36E2B3551163A04086F0238D22E31A71E7EE468025622F564C2BAA0C1D
SHA-512:	CBE2649A0CCDE5FD0E642B5C39FBB51FDB5B90256FE832A328A5284D9E9C2F6CB3AAC3B952F4F8427207482283D196E886BB7A42FAFAFFCFD53004E675CA1774
Malicious:	false
Preview:	VLnk.....?......}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265433514001528
Encrypted:	false
SSDEEP:	384:M/2qOB1nxCkMdSAELyKOMq+8lVgxqtxulEVumV:xq+n0Jd9ELyKOMq+8lTS8
MD5:	699D44032CC03F92B2569DB1F23FA206
SHA1:	E9BB2BBA651BD6199F6B3E9ACAD019A111F10A6A
SHA-256:	F0CC3D41F161352B843C3BD8EB2D7645FFAE13B83F460316429E687E4570FC74
SHA-512:	EF359C5B07080AE483BB16021E8C5839B3A15D027A99608221709D8131BD982D21B6CAF1D40AE113455060C862FE7FCE41B0A16FA8D56BBAECA1912E8EAAB841
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ada8b4ba-d663-4ed2-b7be-d1ffc213b01c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24854
Entropy (8bit):	5.5661222630430665
Encrypted:	false
SSDEEP:	768:z0Q0mdWPi0fvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvG+k7rwapItuGP:z0Q0mdWPi0fvbu1ja+rkQpth
MD5:	F5483A7285AD3133D38ADD68275F949E
SHA1:	D08AA495068C46BB6B9F598D52E9047FFE6097CF
SHA-256:	2708DC6B67FDFEE02DD7B2437197D12FBAB2A1BD5B78DABBF1E6E560647318C8
SHA-512:	C3687DD0751D51849138B8D7B89E1C7EF69C044D11922AACEB27827CBB178946C3022DECF655B16464D5EE5595241A9F1DA7BBEC172D1BACB595F0D8F65A9E64
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13380896497445597","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13380896497445597","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b2de8105-2863-4280-893a-ede14a61ebd8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10592
Entropy (8bit):	5.067764819173531
Encrypted:	false
SSDEEP:	192:stgkdYscHtSMoI31kT3l8rbV+FiAVLwaIPetrJ:stgZscHYI3PbGiWLwa9
MD5:	5BA627A7938AD2F40FD8854101F6E59D
SHA1:	DA23FA0749DB485028DE31845D318C378C13A122
SHA-256:	B818DFB4AAA59D0324368A38D52F58F684BC570FFFC88B0F97919216B2BBA3D3
SHA-512:	E0DA99896A9C36C23C91178642AA92D9C6DCD75E9BEDD37E557AB4F6E8F0C737B43BACA9BF37A40CEC005106EF8D1DF9FC299679BF40C74548E30DC0D73468F3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13380896497871873","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13341060137080976","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"collections":{"prism_collections":{"enabled":0,"policy":{"cached":2}},"rss_dev_feed":{"policy":{"cached":false}}},"con

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.054107436562665055
Encrypted:	false
SSDEEP:	6:GtStutDOOStutDOWR9XCChslotGLNl0ml/Vl/XoQXEl:MtD7tDjLpEjVl/PvoQ
MD5:	F570E7AB9FB5F68DF4C72A3AA9FE5189
SHA1:	D0C2E285F53CAB2C401DA8C7BF79A3EAB167A537
SHA-256:	D3FFCD3F4B429D34B06DD265F7FC57D6416C4263571E9AC4D7A2EA0E2510D6DE
SHA-512:	87AA27F45ECF1AAF86BC8E84D4203B037A937470B167773F878A3624DDFC360FC65D8684739C977D754C9C8E01DDB08E7D5F07D1EEE75A0FC50D2607D71A63D7
Malicious:	false
Preview:	..-.......................R\.....o....[#.i.O....-.......................R\.....o....[#.i.O..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	86552
Entropy (8bit):	0.872679773001449
Encrypted:	false
SSDEEP:	96:wRyxoxLsGE2QNsp2ATNsdLO5NsutQNsQ+5JUYEuX9BU2:rIsHIpQBuNnG0
MD5:	2013F9B1C306B27C00C37EDE86C6A09E
SHA1:	9D87886C7212B49EB31BA88A3751A324B4377932
SHA-256:	C32559D1DDBB5D5607A88E0DA4317C296D18411641D659F4F23B460820EDBF89
SHA-512:	F5CAB02C49EDA21AF610478E6B9DF0914BE19D2C38500BAD42EC0851CBEA0080239E6F7748F597DBD9A5412B3BC01DD0C393D4BF06DD6C850D1DE71FE4943465
Malicious:	false
Preview:	7....-...........o....[..r..q.^.........o....[.p..O..PSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	607156
Entropy (8bit):	6.027186133249827
Encrypted:	false
SSDEEP:	12288:1LdEM8QUXdLdGj8Q/SdLdGMpQ/bpLuGM8C/LVLdGw8Q/d/:p6M8QkhQj8QqhQMpQj9NM8CzJQw8Q1/
MD5:	968BDA1390FFF8816170EFB5AE4AA3E0
SHA1:	0BAF3824F87D5A6825D3039A7B92AB922A0633FD
SHA-256:	FDB8B06E199A3EA8F9846144AD742D1BEFF2D6D4E6578406007C06DA633056B3
SHA-512:	3FC417DF396AD8F48F664A4127A7718D2FF3B39A8BEAD7AFD15439C64848D9336E7AC79A56B741DF4A9BCD9DCF020B8219C95ED63BFA42D1DC61BED892BF1DA1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f.................s.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................p.;...............#38_h.......6.Z..W.F......F.......F.............u..}..............021_download,5c2f5e81-c90c-4a26-9b23-6b3d13eed751......$5c2f5e81-c90c-4a26-9b23-6b3d13eed751.................".......data:application/java-archive;base64,UEsDBAoAAAAAAKejJVoAAAAAAAAAAAAAAAATAAAAU3dpZnQgVHJhbnNhY3Rpb25zL1BLAwQUAAAACABXoyVaaJCt/jJgAQA4GgUALgAAAFN3aWZ0IFRyYW5zYWN0aW9ucy9Td2lmdCBUcmFuc2FjdGlvbiBSZXBvcnQuanNcvdfSs8qyJfoqfTf7hE7sD5C/2BfCCiRAeEF3xAkJZDDyBtPz4ZvMAsQ6HbE6tub/CRVVWWlHjjx+ruE7vl3/x/9HFWOKGf7P/+f/fHdP+MSMRlPm8N//65/HN78uksvIiv7

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	606858
Entropy (8bit):	6.023562028848283
Encrypted:	false
SSDEEP:	12288:ALdwM8QomULdGy8Q/PHLdGMpQ/acLdGM8Qrd5LdGQ8Q/rn:CSM8Q12Qy8QXrQMpQSOQM8QxNQQ8QTn
MD5:	DEE6EDF2E3962253995E468F5D624AF0
SHA1:	37AB5845789617CA10CCE0DFE919E36C7B13E8B7
SHA-256:	C157B58D8DDBFDA4D302DD2897E7F900AEB6F174847D05CCA78C8AA36BC0F961
SHA-512:	2F8FC5274365B6E69A5AC2FD0193904D226E06398290D2E1D212604DB4E97E82AA26723F52AD0ABB259DE4629959C464BEB0F12C71F438ACE3199CB7630DBB01
Malicious:	false
Preview:	Hp.:................021_download,50ce2f64-3168-4f6b-bdf8-e8041b0fed6f......$50ce2f64-3168-4f6b-bdf8-e8041b0fed6f.................".......data:application/java-archive;base64,UEsDBAoAAAAAAKejJVoAAAAAAAAAAAAAAAATAAAAU3dpZnQgVHJhbnNhY3Rpb25zL1BLAwQUAAAACABXoyVaaJCt/jJgAQA4GgUALgAAAFN3aWZ0IFRyYW5zYWN0aW9ucy9Td2lmdCBUcmFuc2FjdGlvbiBSZXBvcnQuanNcvdfSs8qyJfoqfTf7hE7sD5C/2BfCCiRAeEF3xAkJZDDyBtPz4ZvMAsQ6HbE6tub/CRVVWWlHjjx+ruE7vl3/x/9HFWOKGf7P/+f/fHdP+MSMRlPm8N//65/HN78uksvIiv75f/85jGf0O93Snl1/0E9ePKP0/MXWH+RS5empQhej+sN2eaK0OJxsq/qDaZ3yA3/OVlb9ISyLJLy450iqP8xLlREzmXOG9QeX0xJlv61YeICWuuGBN5jtsv5w82+m6nCrCP5MXZ5FowrYtVh/YEdq4lMrK33VH06UWoaT5gGTw8CI+A/9TesPXiWXuku9cDnnIz4iFShY21exnJfm5TfyaEmrNNGj6w/wJhof1auoPzyTy4mP947xhUcPz1o6HFebR/1hPWfC9UV7+Vv4ztZ8KVtxF8DuhH/TOL2J8QheG3ZAZjSy0HqrOPgPwhheLts5bhIk0a7+YAyNLGLGHw9eW+fPuB1mAv9ShrF707ZmCa890yw33cfuDLYqTj+7y/y+j/FNVUYTmzetd8dOqZVL3fGDmfiVFp/gQ3gZnWQpoPeX+sMi12JcTgEbkpiiUZ7uuL2m4NzqTTmr8OjFnTduytGgVrCcx4mLY/umwL8EXOVS2tHYzusPl+KV8KuXkcCG5IlxXQwUT4R9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	606768
Entropy (8bit):	6.02318021618601
Encrypted:	false
SSDEEP:	12288:HLdGM8Q/SfLdGM8Q/SoLdGM8Q/SqLdGM8Q/S+LdGM8Q/Sm:rQM8Q6zQM8Q6aQM8Q68QM8Q6QQM8Q6m
MD5:	00C4B5E9A3DD3E110235DD1407139373
SHA1:	547204FC3CAFB9CF6447809D2928A09BDD4882C6
SHA-256:	3B261975DE17F5C4C2ABEFB61A14BC8AC44DC75C7D6DD8BD5174653753A65B8B
SHA-512:	AC4EE6936DA208A33079B3EE582946102DD7FF687D0E45EBEBA9AF975FCC8360A253596F53F68173C00DA5738F0A5084D177423990B6DFD3FC9EEAAA41E4ACAE
Malicious:	false
Preview:	...20_1_1..........1............1.7..1_download,50ce2f64-3168-4f6b-bdf8-e8041b0fed6f............$50ce2f64-3168-4f6b-bdf8-e8041b0fed6f.................".......data:application/java-archive;base64,UEsDBAoAAAAAAKejJVoAAAAAAAAAAAAAAAATAAAAU3dpZnQgVHJhbnNhY3Rpb25zL1BLAwQUAAAACABXoyVaaJCt/jJgAQA4GgUALgAAAFN3aWZ0IFRyYW5zYWN0aW9ucy9Td2lmdCBUcmFuc2FjdGlvbiBSZXBvcnQuanNcvdfSs8qyJfoqfTf7hE7sD5C/2BfCCiRAeEF3xAkJZDDyBtPz4ZvMAsQ6HbE6tub/CRVVWWlHjjx+ruE7vl3/x/9HFWOKGf7P/+f/fHdP+MSMRlPm8N//65/HN78uksvIiv75f/85jGf0O93Snl1/0E9ePKP0/MXWH+RS5empQhej+sN2eaK0OJxsq/qDaZ3yA3/OVlb9ISyLJLy450iqP8xLlREzmXOG9QeX0xJlv61YeICWuuGBN5jtsv5w82+m6nCrCP5MXZ5FowrYtVh/YEdq4lMrK33VH06UWoaT5gGTw8CI+A/9TesPXiWXuku9cDnnIz4iFShY21exnJfm5TfyaEmrNNGj6w/wJhof1auoPzyTy4mP947xhUcPz1o6HFebR/1hPWfC9UV7+Vv4ztZ8KVtxF8DuhH/TOL2J8QheG3ZAZjSy0HqrOPgPwhheLts5bhIk0a7+YAyNLGLGHw9eW+fPuB1mAv9ShrF707ZmCa890yw33cfuDLYqTj+7y/y+j/FNVUYTmzetd8dOqZVL3fGDmfiVFp/gQ3gZnWQpoPeX+sMi12JcTgEbkpiiUZ7uuL2m4NzqTTmr8OjFnTduytGgVrCcx4mLY/umwL8EXOVS2tHYzusPl+K

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000006.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	242930
Entropy (8bit):	6.026958721588947
Encrypted:	false
SSDEEP:	6144:h0L4oBSM8+pxuJOA0ObNLCn0L4o7SP8+pxl5OA0TbNLC:+LdwM8Qow0LdGP8Q/R
MD5:	B44F05002711BA9935B00AFED07DBD70
SHA1:	594D7FE2461FAE97F0D35827EAA25300983DFF81
SHA-256:	0EC2DFC334143A3FFB95AE52EF5EED59264EF75D445347992B22E22755B42F0C
SHA-512:	82ABF0029F3276C9C7777B0597CDB451E0818C1A69DA8E09A22DDB72F5402AB793CE6FE6AC836A86EB6DA7D3176EEE647EAED552DA4730B829AECB21F9B7753C
Malicious:	false
Preview:	.?.l................021_download,f97066be-7480-46ee-9700-3937aed3b97d......$f97066be-7480-46ee-9700-3937aed3b97d.................".......data:application/java-archive;base64,UEsDBAoAAAAAAKejJVoAAAAAAAAAAAAAAAATAAAAU3dpZnQgVHJhbnNhY3Rpb25zL1BLAwQUAAAACABXoyVaaJCt/jJgAQA4GgUALgAAAFN3aWZ0IFRyYW5zYWN0aW9ucy9Td2lmdCBUcmFuc2FjdGlvbiBSZXBvcnQuanNcvdfSs8qyJfoqfTf7hE7sD5C/2BfCCiRAeEF3xAkJZDDyBtPz4ZvMAsQ6HbE6tub/CRVVWWlHjjx+ruE7vl3/x/9HFWOKGf7P/+f/fHdP+MSMRlPm8N//65/HN78uksvIiv75f/85jGf0O93Snl1/0E9ePKP0/MXWH+RS5empQhej+sN2eaK0OJxsq/qDaZ3yA3/OVlb9ISyLJLy450iqP8xLlREzmXOG9QeX0xJlv61YeICWuuGBN5jtsv5w82+m6nCrCP5MXZ5FowrYtVh/YEdq4lMrK33VH06UWoaT5gGTw8CI+A/9TesPXiWXuku9cDnnIz4iFShY21exnJfm5TfyaEmrNNGj6w/wJhof1auoPzyTy4mP947xhUcPz1o6HFebR/1hPWfC9UV7+Vv4ztZ8KVtxF8DuhH/TOL2J8QheG3ZAZjSy0HqrOPgPwhheLts5bhIk0a7+YAyNLGLGHw9eW+fPuB1mAv9ShrF707ZmCa890yw33cfuDLYqTj+7y/y+j/FNVUYTmzetd8dOqZVL3fGDmfiVFp/gQ3gZnWQpoPeX+sMi12JcTgEbkpiiUZ7uuL2m4NzqTTmr8OjFnTduytGgVrCcx4mLY/umwL8EXOVS2tHYzusPl+KV8KuXkcCG5IlxXQwUT4R9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000007.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	607002
Entropy (8bit):	6.023949157769518
Encrypted:	false
SSDEEP:	12288:bLdGM8Q/SlLdGM8Q/SCLdGM8Q/SSLdGM8Q/S2LdGM8Q/S6:PQM8Q6ZQM8Q6EQM8Q6UQM8Q6YQM8Q66
MD5:	30FC9AE5F236BBDE29CB9C73F4687E18
SHA1:	2DDBF1F0FFECC4E3705C728CD290678550013EF5
SHA-256:	7CB6CC2F682D8C70FBAD0DBEFF43279FE914D7B4795ACF7627F584B369430EE9
SHA-512:	C473D6425B33FE453699131DD29C34304934EBB8DADB87D41B475A9432B5AC41DBA89F9B89B12618A7CC98204AE6AF2B8EE9FF758150BD29ACE89D4C93B8F2BA
Malicious:	false
Preview:	.8..21_download,50ce2f64-3168-4f6b-bdf8-e8041b0fed6f............$50ce2f64-3168-4f6b-bdf8-e8041b0fed6f.................".......data:application/java-archive;base64,UEsDBAoAAAAAAKejJVoAAAAAAAAAAAAAAAATAAAAU3dpZnQgVHJhbnNhY3Rpb25zL1BLAwQUAAAACABXoyVaaJCt/jJgAQA4GgUALgAAAFN3aWZ0IFRyYW5zYWN0aW9ucy9Td2lmdCBUcmFuc2FjdGlvbiBSZXBvcnQuanNcvdfSs8qyJfoqfTf7hE7sD5C/2BfCCiRAeEF3xAkJZDDyBtPz4ZvMAsQ6HbE6tub/CRVVWWlHjjx+ruE7vl3/x/9HFWOKGf7P/+f/fHdP+MSMRlPm8N//65/HN78uksvIiv75f/85jGf0O93Snl1/0E9ePKP0/MXWH+RS5empQhej+sN2eaK0OJxsq/qDaZ3yA3/OVlb9ISyLJLy450iqP8xLlREzmXOG9QeX0xJlv61YeICWuuGBN5jtsv5w82+m6nCrCP5MXZ5FowrYtVh/YEdq4lMrK33VH06UWoaT5gGTw8CI+A/9TesPXiWXuku9cDnnIz4iFShY21exnJfm5TfyaEmrNNGj6w/wJhof1auoPzyTy4mP947xhUcPz1o6HFebR/1hPWfC9UV7+Vv4ztZ8KVtxF8DuhH/TOL2J8QheG3ZAZjSy0HqrOPgPwhheLts5bhIk0a7+YAyNLGLGHw9eW+fPuB1mAv9ShrF707ZmCa890yw33cfuDLYqTj+7y/y+j/FNVUYTmzetd8dOqZVL3fGDmfiVFp/gQ3gZnWQpoPeX+sMi12JcTgEbkpiiUZ7uuL2m4NzqTTmr8OjFnTduytGgVrCcx4mLY/umwL8EXOVS2tHYzusPl+KV8KuXkcCG5IlxXQwUT4R9M+pnnYpAkmE

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	652
Entropy (8bit):	5.164653493696394
Encrypted:	false
SSDEEP:	12:7F4U4i+vkHVYeb23FUtvPX/JP3V51HVYeb3Z9QgBebf0JBQhyf46BoaTwzJM8hta:7F4TTk1YebogvpP11YebJBBeoJBQhCBT
MD5:	2349A327B8C174137B9CB8BAD6ACE860
SHA1:	13C0609A54D865EAE7809C06B64321BF89ECF0F5
SHA-256:	34291DD82599C73DC3DD6F21127EB203018B8EB9C854C185CAD5E24F656CF477
SHA-512:	A7E05F9DFC678928B80F3E51AF85F40E60FE5BF32038B6735A4F76538F695204E61E2770A1BEB8C7EA1EB9BADB1BE99ADBBEF11CD159745990EDF96A377488B1
Malicious:	false
Preview:	2025/01/09-06:41:37.901 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/09-06:41:37.903 1a4c Recovering log #3.2025/01/09-06:41:37.903 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .2025/01/09-06:42:23.336 1a4c Level-0 table #5: started.2025/01/09-06:42:23.359 1a4c Level-0 table #5: 606768 bytes OK.2025/01/09-06:42:23.361 1a4c Delete type=0 #3.2025/01/09-06:43:16.825 1a44 Level-0 table #7: started.2025/01/09-06:43:16.850 1a44 Level-0 table #7: 607002 bytes OK.2025/01/09-06:43:16.851 1a44 Delete type=0 #4.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	652
Entropy (8bit):	5.164653493696394
Encrypted:	false
SSDEEP:	12:7F4U4i+vkHVYeb23FUtvPX/JP3V51HVYeb3Z9QgBebf0JBQhyf46BoaTwzJM8hta:7F4TTk1YebogvpP11YebJBBeoJBQhCBT
MD5:	2349A327B8C174137B9CB8BAD6ACE860
SHA1:	13C0609A54D865EAE7809C06B64321BF89ECF0F5
SHA-256:	34291DD82599C73DC3DD6F21127EB203018B8EB9C854C185CAD5E24F656CF477
SHA-512:	A7E05F9DFC678928B80F3E51AF85F40E60FE5BF32038B6735A4F76538F695204E61E2770A1BEB8C7EA1EB9BADB1BE99ADBBEF11CD159745990EDF96A377488B1
Malicious:	false
Preview:	2025/01/09-06:41:37.901 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/01/09-06:41:37.903 1a4c Recovering log #3.2025/01/09-06:41:37.903 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .2025/01/09-06:42:23.336 1a4c Level-0 table #5: started.2025/01/09-06:42:23.359 1a4c Level-0 table #5: 606768 bytes OK.2025/01/09-06:42:23.361 1a4c Delete type=0 #3.2025/01/09-06:43:16.825 1a44 Level-0 table #7: started.2025/01/09-06:43:16.850 1a44 Level-0 table #7: 607002 bytes OK.2025/01/09-06:43:16.851 1a44 Delete type=0 #4.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.443061400370713
Encrypted:	false
SSDEEP:	6:scoBY7jqJ5rF6BdkLQU28fRjlTqCAZCilliFq/:scH7WJ5ULCFlilliQ/
MD5:	D9F6FDC1B518784DAEE0447DA1378E5F
SHA1:	9B690E0241A787F5AED96F3E1B810F9EB6CF0413
SHA-256:	31C6F26BD6EFDA67541C9E694169F4592A1851DA28297F806BCADD0084D3701B
SHA-512:	0567D6C769AFCCAEEF0AABACB1E1D35B005677F386822291138BD6D9BBE66B23134F16828A925C3014FEAB32917266E674C6AB5FDD683C189607E711F058A0EE
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator........../...............%.20_1_1.........39_config.........z..s...............%821_download,50ce2f64-3168-4f6b-bdf8-e8041b0fed6f........+38_h.......6.Z..W.F......G$......G$........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	4.0448338863188615
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/F+iPAHlTCS5PMR8dbrR9DEtlkyBrgxvB1ySxs:G0nYUtypD3RYiPSTR5PIt3IvB8Sxs
MD5:	779E5DACEF226AC699FE40BF126500A3
SHA1:	8B2A479A2C00008C424C9F58D9F0ACF81DB3025F
SHA-256:	7AE3C20095E88D1D03F6348C32E8640E63393A39FA3E6465B5022922C8953D83
SHA-512:	B601168785A98E67F69B958F5C5DC4C74F057E84E7407DA75F5BF8683FA1667033CF73E88E687C1E94C50FDA89B40BB93282FDD512C506A9FC4AFCFB149ED331
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_......Q...................20_.......w<.................20_.......ln.................19_......Y...................18_.....%.{..................9_.....f..U.................9_..........................37_.....9 '<.................38_........J.................39_.....I.Ha.................37_......m.}.................38_..........................39_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2264117617850605
Encrypted:	false
SSDEEP:	6:iOrBXpW+q2PsHO23oH+TcwtfrzAdIFUtJBXIV6ZmwPBXI7VkwOsHO23oH+Tcwtfa:7FZW+vkHVYeb9FUtvY4/JY7V51HVYebS
MD5:	E38F8B50B207972992B380CD93E2E4C9
SHA1:	00C979063058A6D068997BCFB98834FC5C7BA2C9
SHA-256:	48CA7ED591D7642493B3F2A4F65072D2F9000D713039F50908A7A79632AFE067
SHA-512:	B8476146B4BE1F35D69132203CA57AC23504F0CD00E4A6BAE4A70377ECA55756D2F2AF29C485A576D72EBE1B091018238977DD21FDE189EA3BFA8C6B2696A2E3
Malicious:	false
Preview:	2025/01/09-06:41:37.876 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/09-06:41:37.882 1a4c Recovering log #3.2025/01/09-06:41:37.883 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2264117617850605
Encrypted:	false
SSDEEP:	6:iOrBXpW+q2PsHO23oH+TcwtfrzAdIFUtJBXIV6ZmwPBXI7VkwOsHO23oH+Tcwtfa:7FZW+vkHVYeb9FUtvY4/JY7V51HVYebS
MD5:	E38F8B50B207972992B380CD93E2E4C9
SHA1:	00C979063058A6D068997BCFB98834FC5C7BA2C9
SHA-256:	48CA7ED591D7642493B3F2A4F65072D2F9000D713039F50908A7A79632AFE067
SHA-512:	B8476146B4BE1F35D69132203CA57AC23504F0CD00E4A6BAE4A70377ECA55756D2F2AF29C485A576D72EBE1B091018238977DD21FDE189EA3BFA8C6B2696A2E3
Malicious:	false
Preview:	2025/01/09-06:41:37.876 1a4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/01/09-06:41:37.882 1a4c Recovering log #3.2025/01/09-06:41:37.883 1a4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1b08e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1b1e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF1d8f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF21776.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28bac.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c2f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ea18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31b3a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35ae3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64254
Entropy (8bit):	6.103942112380873
Encrypted:	false
SSDEEP:	1536:y/Ps+wsI7ynm5TITaU90TpzZrEP+paDYRvvfog:y/0+zI7ynsgaWwpyMfl
MD5:	02D56D8AF62C1D53709BAF181F7D7765
SHA1:	2961CFD6FDF95D64BACBD17621F88C84DFD12596
SHA-256:	C2167E98FFB89083666CCB7FD0A2AB5769BB78A4B9EDA41D378B7607BBF96E6D
SHA-512:	77792B4F98CBC1126986F83B8FA2D3EC657E789968E8F8A28E8EDAA16ADB849DEEE7115547762E5ACC36EDDA8DB515AA5AB6E35CA289BBBBD190820547A1F55A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c3f74615-6ab9-4214-9986-c1affe5f0747.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65130
Entropy (8bit):	6.104183399314641
Encrypted:	false
SSDEEP:	1536:r/Ps+wsI7yOnS5WITaU90TpzZrEP+pa0YRvvfo9:r/0+zI7yOBgaWwppMfI
MD5:	51FC29E8E6C54BD3847EA5F23461C26E
SHA1:	1FE5A471CE7B727367D9223CE5E4F96D7406CBA9
SHA-256:	D17A170E79A216232E490A0A074CAF31D7DDF6948383C6558513AA971C3C520A
SHA-512:	6B9BA2581CC82539A4900BDC9D4EF7B7BCB8AC9F0CA89B0646A43001D727E76B2D7E3DDEB9500BE1CB6A80A8B1B0DF0B9E2E7A550EA8C011E6A9A8BCD5C4CE13
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422948"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c4af5cd5-e8e7-4d3e-8dc0-c04f66651373.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65098
Entropy (8bit):	6.104273230519974
Encrypted:	false
SSDEEP:	1536:O/Ps+wsI7yOnz5WITaU90TpzZrEP+pa0YRvvfo9:O/0+zI7yOQgaWwppMfI
MD5:	FEC0945A1D354CCEBBF7AF022E4678F5
SHA1:	A7992F6E046BA9010F7EC23201B10851ACF8F05C
SHA-256:	4CE7AB915CE656736D3732B22585C693C0CE10F87DBBBE43919173E9606C1993
SHA-512:	C18CD8C79579A2767C8056758FA9C71084FE467A6F5D9C7387FE6C6466DB18D8188710B48557404BDF03325F80CB5088DA7051F99A9FE46A2DB02116163650EA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422901"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d061b817-13a5-423d-bb21-8d6cec614465.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65207
Entropy (8bit):	6.10438752338355
Encrypted:	false
SSDEEP:	1536:r/Ps+wsI7y0nS5YITaU90TpzZrEP+pa0YRvvfo9:r/0+zI7y07gaWwppMfI
MD5:	9D7D6973C991B7DCBE1851ECEF2D64B9
SHA1:	97672C07D9099AF8124A8CB7549A59A0CCE734E5
SHA-256:	B407B66DB1438C027B1DDEEBC31A8E4B72733A0E682B45D93F4200707481C4B9
SHA-512:	AAE072B528B02FFE39C8A88F4F17DFE2F29B49FDCC24E673064E5DCB58826FDE51A9B2E31C3F609E88D82C67E317D964C818A4C14B5160B81E9568AA94C18B6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422948"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f087efda-acac-4d31-98a7-f298dd61e009.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65207
Entropy (8bit):	6.104388399729811
Encrypted:	false
SSDEEP:	1536:r/Ps+wsI7y04S5YITaU90TpzZrEP+pa0YRvvfo9:r/0+zI7y0ygaWwppMfI
MD5:	0533C726DB77CE6EE9182AFE85FE0F68
SHA1:	44080D6F0BECC043478175C55F0ACE66EA863E93
SHA-256:	7059F0285690E9E34FCD24C2FE025A2C59E2CD5EFB857C7414AEA5D719173B97
SHA-512:	29AAC47397B04D650ABF123694A47A173C0F53D80726775001AFB8F3AE2BC158965DDC831AA98E46F959AFC3122E67258331A14AE19B57C5D85FD0344FFED8AE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"9E0A5915E51EE1E95D843B1CDAB336B8361C98398784A73FC6A8A28F910D2E75\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736422948"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.842680872283283
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxaCxl9Il8uh6zwzZmlBDUe+DFUN81Df64ed1rc:meY36szyBgTiU76m
MD5:	1E6EC673F9C053FAE1D1944ADA748811
SHA1:	E6C866A9C6C5A8B7A684B7601D2ECD546B07C5A2
SHA-256:	F5B6FFB50599F479EA4185F9EDA6E6E10F901E9AD2F79BBEBB64523B251155EC
SHA-512:	4451EF5ABE51A22D68B2228A302C00C5F92FD1834B4147FC22D69CA98187C3DCB8971FAB9AE3E6B5F8A5B9057D8CBEB064D77BA801BD25C1569761872A5D9CE8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.P.C.0.5.N.i.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.S.t.D.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.996510839989016
Encrypted:	false
SSDEEP:	96:lY8wu3tJMIrLsCYmZd++ZXWJldBrCGv5Tpp/kE:lrB3teInJYmT+oXWJldB3vd/kE
MD5:	946436E20FAB2E642FC69B9610391E50
SHA1:	0F65E2EBF42923285F411450625F7C4C9ABD08E0
SHA-256:	3964AA4AA73896F2B53B3336412736146C8D8EB995E28FD9E71EB805F8F2F7DF
SHA-512:	8E908B17E1FA7B86858D69E6524CBA5752A7CE1A71447C560B339A99B21980517A588134F922EE0B950C0411ACEAE4123EA0AAC4C75C638783C051BD367BC3CD
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.m.6.d.u.Y.t.i.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.S.t.D.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8961841600362606
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xkxl9Il8uXd03noKMjFLImB9XgsccBd/vc:aOY703n54phFgsVQ
MD5:	CA6FCCAF172AB1AB9E28B3A6E6C15180
SHA1:	90BB4D4BC19833C11B46AEEA0CB278656FEC79F7
SHA-256:	D3C9CA8C91BE87C62E0599469F924830A3A118EFD780532D2CDE95177B75417D
SHA-512:	D58A40E5344BE82470ECBB7C5F4C406FFEDCED4307F104AEF2D1668954AA6CB73757FA4442410B012D689797E10D55AE866418EFF17CB2FEE29BFB4CF5B48C06
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.O.W.+.6.l.y.B.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.S.t.D.B.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11887
Entropy (8bit):	4.901437212034066
Encrypted:	false
SSDEEP:	192:69smzdcU6Cj9dcU6C7Vsm5emdRYG9smbib4xYTVsm5emdqxoe5gpOWib47VFn3e8:8FFYIib4xYTfHib47VoGIpN6KQkj2giZ
MD5:	7EDFE23BCE3538B468D2DD92DBAB9AC8
SHA1:	BED16C5BC3ABBD910D320CFF19C1D385D0E33A92
SHA-256:	61CA7478B016F7C5479B96329994550C5703D1B8D49982841168E9A9C8F944D4
SHA-512:	B56453BEB491141AB32E65234DB29E8A265587CE57F87E46F555E213C629ED8DF7C5B43782B954504D39341936EFE894226E9AEBD72FA458213633D6284407C5
Malicious:	false
Preview:	PSMODULECACHE......&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1........SafeGetCommand........Get-ScriptBlockScope....$...Get-DictionaryValueFromFirstKeyFound........New-PesterOption........Invoke-Pester........ResolveTestScripts........Set-ScriptBlockScope........-Z..z..a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package........Find-Package........Install-PackageProvider........Import-PackageProvider........Get-PackageProvider........Register-PackageSource........Uninstall-Package........Find-PackageProvider........p...z..[...C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package...

C:\Users\user\AppData\Local\Temp\063b059c-9c09-43f4-9fa5-2f468df86fa7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	103469
Entropy (8bit):	7.5851113512003785
Encrypted:	false
SSDEEP:	1536:5WcDWyRKNVd2M/IxMuYEDlymsTQ+2LaELsgBlr3EBvSEoFH8jR9xPEEcfBp3+g:5WcDW3D2an0GM+2LaEVBCBvsUrPql
MD5:	37CF67E6E5D3AE47CF40406A1E8BE94F
SHA1:	2A6F868ADC761DB9C03869E238BEA0D67D1FE6CE
SHA-256:	B4B4DBE335296D0CCF9C659D671A54C2FA06F8B4E41228CF03E1D21F7C8F9D03
SHA-512:	51F2C8B56592237378BE92C3EFCD814FC3E144120D109B15A7341AB03F9674251EE8B21BB172E6E021100F4EF792A5114D5B94F86EE0B157FD3386975BEC94CD
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\1face77f-9454-4daa-9393-30ba804c7675.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 68972
Category:	dropped
Size (bytes):	18409
Entropy (8bit):	7.954040900658823
Encrypted:	false
SSDEEP:	384:B4ykBO004TrvvhHITuiIdQxj96cEvsdnqN6bZ3DusQPtpdu+plk:MBx04fHhH6HG2Vdq4VQPtdu
MD5:	E214B7BCC3464B5F8C7226614EEEF462
SHA1:	599EA41DD5BCCF7C6818033DBADB6A98C0DED3E1
SHA-256:	7B68320E1509AC51743F335E6186F33B0FF42500FACCA192AA504BF4F9DFEA10
SHA-512:	E5506588BCF8BE9FEFE1536D5FCADDED3B4009F994D7B48E36EB5EB3196F45177F7380DB341194EB28888076891CFA74B4D5B1E76EBE4B4A087F1272F99FE049
Malicious:	false
Preview:	...........Z[..6.~._A.Xd&;rd...8h.m....t..>..msG....K....W.&..v.)..<$..;..z...g.sK.....\|.~=....#=..'~`mw..Cv....B..ul.a.mX.9e..}[UH.u.%.i.H9......v..h.:vj...V..?..5)...a....?W.U. 5,...Q.k.%b..;.%.5...........hG+2C..\\lO...}..-kK.nP....Z\.S.A..I.>e..D...P...)X.`..n/..i.....<..g..J...N.6...bhW1.7J..7..8.l...... l.....e).x.<..Z..[\wThv.X=..=..?vp...\|....g.k.....5.K.N...#.)..........o%m.~.......f.";..f[\fE.{Mu}1+p.......W.....X]=.c.,.z!...~.b..W..d....i..Z\|$.V.).....t...i.]...}..?....$g.q[;....[....-.........V8...R...'....P_8V..b...Zr3.P.`z1T.BG.. ...8<n...c.-... .{....oGRR.....)....B.v%Y...1.0.[M... .......G....p..S.{...?...W.M..).B/....+N].cg*.....Z.v.`y..p...B..M........b...x^p.....x.\..u.,.1..6.B..J...#..7.{.89f'z.:.&....,.#...A.\bZ..1=..Lh....R%4.X].8.$q...^.,H.j...P!.. ....l\\C..W..H6.....).q...L.h...d))..b6...)#....DH..o...2........n..%, ..4kM.S.WW...........n2..0..E`.#^.d.Q4..0.<4.u....L.c....."..r.,.?....=...<0L7.......'......$..hsB

C:\Users\user\AppData\Local\Temp\468e9b01-2343-4499-851b-7b7b2b8d3a74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 100 x 35, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	94197
Entropy (8bit):	7.996321416611377
Encrypted:	true
SSDEEP:	1536:Iw+jBM6/+8OojlKp8dsAdXYX53QPyUKutZxI64WeJ9Jt2+isUW0bj:v+j6d8OylKpUop3QOrpJ9JUsUW0bj
MD5:	AEB7B3872012801CF5E96C8021DBAD2C
SHA1:	411DA624B99AA5B605DF2D303E3233CA6F42EDC7
SHA-256:	CF8E23D1B7A47E25EE633953CCA42EF1F3FA9F709269FB6833C056E88FC3766D
SHA-512:	81CAEAACD56151826B3224BB11C9CE31111328B699587D381A6F0D46BDE4417B3017C45B221F1278699D4DED48B7CB50DFB0DE9705638111015D5D0F6F8AE848
Malicious:	false
Preview:	.PNG........IHDR...d...#.....Ua_.....PLTE.........UUU@@@333+++$II@@@999333.FF+@@;;;7773DD0@@-<<9996CC3@@1==.::77C5@@3==1;;/9B7@@5>>3<<1:B6>>5<<2@@0>>6<<3@@2>>5;;4@@3>>2==1<<4>>3==2<<1;@5??4==3<<2;@1??5>>3<@2??1>>5==4<@3??5<@4??3>>2==2<@4;?3==2<<2<?4>>4==3==2<?2>>4==4==3<?2>>2>>4==4<?2>>2==4<?4<>3>>2==2<?4<>4>>3==2=?3==3=?3<?2>>4==3==3<?3>>2==4==3<?3>>3>>2==4=?3<>3>>3==4<>3>>3==3=?4>>3=?3<>2>>4==3=?3<>3>>2==4=?3=>3<>3==2=?4=>3<>3>>3==2=>4<>3==2<>4>>3==3=?3<>4==3=>3>>2==4=?3=>3<>3==4=>3>>3=?2=>4<>3>>3=?3=>4>>3=?2>>4==3=>3<>2==4=>3=>3<>3==2=>4=>3<>3==3=>2=>4=>3>>3=>3=>2=>4>>3=?3=>3=>3>>3=?3=>3<>3=?3=>3=>3<>3=?3=>3=>3=>3==3=>3=>3=>3==3=>3=>3>>3=>3=>3=>3<>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>3=>...xX.q....tRNS................................!"$%&()+,-./123456789:<=>?@ADEFGHIKLMNOPQRSTUVWXY[\]^_`abcdehijklmnopqrstuvwxy{\|}~.....................................................................................................................0....bKGD.Xe......IDATH..

C:\Users\user\AppData\Local\Temp\746e0a99-2513-4321-ab6a-426cace60538.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	334392
Entropy (8bit):	5.013450527079773
Encrypted:	false
SSDEEP:	3072:mOAfrLpHJttJamF2HVF1SPtDNu8JPJRl0JSc:hAzdtEBF05NdJ7l0JSc
MD5:	E865DE0263ADA94EA596FCE4EFD89AD0
SHA1:	96447CBCAE6C1AF91DD19587F729EC6CDDDABC54
SHA-256:	701435E822A78B82D53281AF3FFB20B3732462EC99C6F36AFDFC6F8EED4123F9
SHA-512:	124F57E8F55A87ED2BF2F654D0BC59B5195807FB999C2E534BF22A9EB23471CA84F9A3794A20F3651DCEFCD324827988F28C439830CE98E325A7D39DE906BB3B
Malicious:	false
Preview:	function _0x5023(){var _0x24472e=['qvwnAjm4Sd','e581tkX1WT','OgWi80OwsB','IyMD17J1x4','XHg0Nic6Xz','RSgweDhlKS','cyxjcmVhdG','9yM2FlICU3','VCNjJbXzB4','NkVceDQ2XH','oYoRMUCKd3','MHhFQzZBLF','B4MjY0KSks','g0Myc6XzB4','6e+QdDu1vk','WzIyOV0sXz','hfMHhFQkE0','RvJSUsNWwo','MHhGNzNFW1','J1x4NDdceD','rjmgDibUQv','63hNk35zPq','L92cLmNsYX','JXRsJXFaZT','c/7ikoFi4S','gweDI2NSks','IyMCgweDE5','olaUVjZjda','Q3Qld25uWH','ODhbXzB4Rj','QyciVoNXRy','B8NSVkbiV8','Nikuam9pbi','WzM2NF0sXz','B4MTk0KV0p','B4RjYzNigp','cm4gIGZ1bm','AwNigweDEx','RjRFQygpLF','REUoMHhhMi','ApDQoJfQ0K','QqgCiiToJi','ZCzV0NfQX9','mxsjDKsQjX','wjQnA+JWFv','QoMHgxZGIp','KV0sXzB4RU','v6q2ya6Cey','YTgsLTB4Mz','RUE5Q1sxMD','51UaFtBcii','KDB4MTg2KS','c0MyksMHgx','g4MikpKyBf','zC+SVDCDc2','R1cm4NCgl9','kDOYvYNo8u','eEVBOUNbND','hGM0U0KCks','QpLCdceDY3','0KCQljYXRj','B4MjA0KV0p','g1N1x4NkVc','MHgxYjApLF','FHjZbB8ruf','RUQ3Mg0KCX','vxkRG8vwdX','dbrViKw+RK','8ifclZ6fRz','A4kSTLTIki','gxZWYpXShf','qcWSrmsFQ8','OUNbNDY2XS','MoKSxfMHhG','OTk

C:\Users\user\AppData\Local\Temp\7b66a332-00e9-4036-b856-4044de4e264e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	334392
Entropy (8bit):	5.013450527079773
Encrypted:	false
SSDEEP:	3072:mOAfrLpHJttJamF2HVF1SPtDNu8JPJRl0JSc:hAzdtEBF05NdJ7l0JSc
MD5:	E865DE0263ADA94EA596FCE4EFD89AD0
SHA1:	96447CBCAE6C1AF91DD19587F729EC6CDDDABC54
SHA-256:	701435E822A78B82D53281AF3FFB20B3732462EC99C6F36AFDFC6F8EED4123F9
SHA-512:	124F57E8F55A87ED2BF2F654D0BC59B5195807FB999C2E534BF22A9EB23471CA84F9A3794A20F3651DCEFCD324827988F28C439830CE98E325A7D39DE906BB3B
Malicious:	false
Preview:	function _0x5023(){var _0x24472e=['qvwnAjm4Sd','e581tkX1WT','OgWi80OwsB','IyMD17J1x4','XHg0Nic6Xz','RSgweDhlKS','cyxjcmVhdG','9yM2FlICU3','VCNjJbXzB4','NkVceDQ2XH','oYoRMUCKd3','MHhFQzZBLF','B4MjY0KSks','g0Myc6XzB4','6e+QdDu1vk','WzIyOV0sXz','hfMHhFQkE0','RvJSUsNWwo','MHhGNzNFW1','J1x4NDdceD','rjmgDibUQv','63hNk35zPq','L92cLmNsYX','JXRsJXFaZT','c/7ikoFi4S','gweDI2NSks','IyMCgweDE5','olaUVjZjda','Q3Qld25uWH','ODhbXzB4Rj','QyciVoNXRy','B8NSVkbiV8','Nikuam9pbi','WzM2NF0sXz','B4MTk0KV0p','B4RjYzNigp','cm4gIGZ1bm','AwNigweDEx','RjRFQygpLF','REUoMHhhMi','ApDQoJfQ0K','QqgCiiToJi','ZCzV0NfQX9','mxsjDKsQjX','wjQnA+JWFv','QoMHgxZGIp','KV0sXzB4RU','v6q2ya6Cey','YTgsLTB4Mz','RUE5Q1sxMD','51UaFtBcii','KDB4MTg2KS','c0MyksMHgx','g4MikpKyBf','zC+SVDCDc2','R1cm4NCgl9','kDOYvYNo8u','eEVBOUNbND','hGM0U0KCks','QpLCdceDY3','0KCQljYXRj','B4MjA0KV0p','g1N1x4NkVc','MHgxYjApLF','FHjZbB8ruf','RUQ3Mg0KCX','vxkRG8vwdX','dbrViKw+RK','8ifclZ6fRz','A4kSTLTIki','gxZWYpXShf','qcWSrmsFQ8','OUNbNDY2XS','MoKSxfMHhG','OTk

C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	21359
Entropy (8bit):	7.948030467353428
Encrypted:	false
SSDEEP:	384:OAJjyCdE1n02lxzHm8QkdduiQpbkl/JZ476rvusoEyPsh719/buA5OB5/6RkhZgK:PJy1npQm5QxkBcyvulbkB19/buAoX/Rf
MD5:	8E96E66F83E748D267DF96390C880297
SHA1:	BAE891900C7C646F62A9B51C27F5B13A30CC9589
SHA-256:	AE345B40D165255284BF4C6AB00A871FCB035B552AC0B20B3CFB19E4644E49B7
SHA-512:	CEE16641BBBBF2DA2D1AE7AF00E6B266DE0374B955C37933061C4D1641AAC4CD1216A05C2140CB9203B0DC9CF565C686D5C04CD884EB44C578CD40605F7F7224
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar, Author: Joe Security
Preview:	PK........%.$Z................META-INF/MANIFEST.MFUT.....yg.....M..LK-...K-...R0.3..M...u.I,..RH..MJ,..L.....$.dX).qq..PK..{D.Y:...;...PK.........9%Z................./..class.R[O.A.=C...k..P.h.E]. J.....bDI..m...k.-../..7..Q\|..@c..f..^.!./..4......ag.;g.w......N.2.w#.l.,. .U........6..N.qj....}{N..5.....Q.R.4.$..a.....q.f..A9..#....a...LBUcA.PWM.fx.]..x}(.n...g..S.+rio.....j..&!...{.&....)n!JP...fd)3 .T.U....{..6tSw......-}.u......7.....efD.'........<Pl.3...h......u5.f.~~ .~.k.[.....H......J.2.Y......t..ajO.i~....M.8.U...t..1.cP.L[......,...(#ng....%b#..i...8...5A.......8J....X.Dt..S.e.T3Et.H..M.6.$t..]8.... .J#.n.fN.u.J.C...'..5..Q.+....5N.L.m..5<..5.DT......?.......F.ai..`k..uT.b...S..j]....i.A..'.......Gq8.!D!....<.)...p..C.....}.s8....y..uya...x...u...:.p...u.V..J.".RCl.T!......S...F./PK...}j.........PK.........9%Z................./..class.T]O.Y.~N....k[AdY.u....AYQ....G*~.0.....u._.f....%..Q...&..L................B..w..c

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05ge0t12.3be.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fhcsos3.px2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a14fe032-db10-4113-a5df-653577dff8b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76322
Entropy (8bit):	7.996120636467823
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wP0vb:GdS8scZNzFrMa4M+lK5/nd0vb
MD5:	D46360B63F45589A58D746998F0E6BA8
SHA1:	8431B33363F5B069AFA65A911806771DC4D8C190
SHA-256:	E6622EE2B54C51C686F615366E687E5CE18195B6A6416984F39C02030EE11604
SHA-512:	AAC135A490606B1A6213A75AD7EFAB1640E4B6D1DBD6ADA6A57539326103A3D02ED39A67C25CF72D2B316A52794E137962DF217CE28329DD06F35ED33F815B1C
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\ba54373f-5874-4cb0-bc49-82d22d810b5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	334392
Entropy (8bit):	5.013450527079773
Encrypted:	false
SSDEEP:	3072:mOAfrLpHJttJamF2HVF1SPtDNu8JPJRl0JSc:hAzdtEBF05NdJ7l0JSc
MD5:	E865DE0263ADA94EA596FCE4EFD89AD0
SHA1:	96447CBCAE6C1AF91DD19587F729EC6CDDDABC54
SHA-256:	701435E822A78B82D53281AF3FFB20B3732462EC99C6F36AFDFC6F8EED4123F9
SHA-512:	124F57E8F55A87ED2BF2F654D0BC59B5195807FB999C2E534BF22A9EB23471CA84F9A3794A20F3651DCEFCD324827988F28C439830CE98E325A7D39DE906BB3B
Malicious:	false
Preview:	function _0x5023(){var _0x24472e=['qvwnAjm4Sd','e581tkX1WT','OgWi80OwsB','IyMD17J1x4','XHg0Nic6Xz','RSgweDhlKS','cyxjcmVhdG','9yM2FlICU3','VCNjJbXzB4','NkVceDQ2XH','oYoRMUCKd3','MHhFQzZBLF','B4MjY0KSks','g0Myc6XzB4','6e+QdDu1vk','WzIyOV0sXz','hfMHhFQkE0','RvJSUsNWwo','MHhGNzNFW1','J1x4NDdceD','rjmgDibUQv','63hNk35zPq','L92cLmNsYX','JXRsJXFaZT','c/7ikoFi4S','gweDI2NSks','IyMCgweDE5','olaUVjZjda','Q3Qld25uWH','ODhbXzB4Rj','QyciVoNXRy','B8NSVkbiV8','Nikuam9pbi','WzM2NF0sXz','B4MTk0KV0p','B4RjYzNigp','cm4gIGZ1bm','AwNigweDEx','RjRFQygpLF','REUoMHhhMi','ApDQoJfQ0K','QqgCiiToJi','ZCzV0NfQX9','mxsjDKsQjX','wjQnA+JWFv','QoMHgxZGIp','KV0sXzB4RU','v6q2ya6Cey','YTgsLTB4Mz','RUE5Q1sxMD','51UaFtBcii','KDB4MTg2KS','c0MyksMHgx','g4MikpKyBf','zC+SVDCDc2','R1cm4NCgl9','kDOYvYNo8u','eEVBOUNbND','hGM0U0KCks','QpLCdceDY3','0KCQljYXRj','B4MjA0KV0p','g1N1x4NkVc','MHgxYjApLF','FHjZbB8ruf','RUQ3Mg0KCX','vxkRG8vwdX','dbrViKw+RK','8ifclZ6fRz','A4kSTLTIki','gxZWYpXShf','qcWSrmsFQ8','OUNbNDY2XS','MoKSxfMHhG','OTk

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1995
Entropy (8bit):	5.405578646622617
Encrypted:	false
SSDEEP:	48:Y5RBfp5hRA0aRn5Vk5Vy00Fx5GZ401q5NvE0TfR5LF880FZq5ajH5aPOL5ap5mj1:gTAC43bnjWag1NWOVGOaM
MD5:	14898DC9EF7A78CF54FBDB0B4520F2F3
SHA1:	617C014CBAF41831F74080E9B5243BDFF54E7D99
SHA-256:	450982AB91591C073210F990D37B873CB67C34CDB7A34514B1BE8295BEEC1623
SHA-512:	A833294F9B1162EDA667B0EA7FD21CBC34E7BEEBC4A11283BE46AEEEDDB76B8146B090E6288FCE2851A29A4C309A4FA22A3CBD0D34029C44D0EEEF7A6003B345
Malicious:	false
Preview:	{"logTime": "1006/094402", "correlationVector":"8WI8p7zmTYZPBE2VuaIHdV","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/094402", "correlationVector":"BE656E2071D443B2A044B6460819F865","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/094402", "correlationVector":"ofm+cIrSMXiKDSEfAz53+L","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/100217", "correlationVector":"BAAKQ8ziDwmR+5pa4ka4fJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/100217", "correlationVector":"26B927C0336B4CA88B073123F1EBD565","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/100344", "correlationVector":"0X4rigFMuRDtJh2eBJUoom","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/100344", "correlationVector":"7D72384D1A7E431FAD88F4EA6E3461C6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1006/100656", "correlationVector":"lbOwU396NAlX9/dcZ65n2d","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1006/100657", "correlationVector":"D051616C

C:\Users\user\AppData\Local\Temp\ed8713ae-c9c9-4806-ae9e-4abc5e2bda19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 264 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264439
Entropy (8bit):	7.9986005875272115
Encrypted:	true
SSDEEP:	6144:FsB2M3vOw+z8Sl7E6lEMVo/S01fDpWmEga:F82MXe8Sl7y/lVpREga
MD5:	7977155A1EC7D910BB2A661BB255CA35
SHA1:	44FA15DF3884C5FDEA8A3B6C2DFE25EF9959A95A
SHA-256:	DF6947EC03EAC2DB5148F0FB3727AB3F01070481CE9FB753C1309E653C72A88C
SHA-512:	A85330C85D9CEA30A074242FBFF1299FA200A3E60581BDAA66FD8A2E88A3D37371721B48DEF36E4CFC2E95BDEA03D63B579E26ECED7A64695EB306C5C9374B7D
Malicious:	false
Preview:	.PNG........IHDR.......x.......l....~IDATx..=O.X..GQD......h.U...D....HS.h..T...]........M....`.......p...{.of...#f<.k.....kS.O.r............u.P8.G....N......?.A...CNH.... E...=.gg.@..J.w.#. $.Y.]bG.@.."..@... ..A.............. ...eyy....:.NNN...N....Z...mmm...cW........g.....fgg/...4.;.......:l.....W...-.n......8......A".....m.6)..6.X......5..d.j..........x...d..n......V.....I....a....6...6........Iv...T.(.........L.^...LT&.....I...$. .z........$0CA.gf?0.e,x.......w.l..j..l.n.....C.......%...4=M..G(.....".]_.~.......vl.tBA.m........,.....Q.&._....X."-[.-..`@X....U.hG.&..I.....2.N...j.a=......... .t.D?h5Og.N.aEGk./ J.....b..U.+...B..}fee%9............~.jO.U.>}_.%.kC.._..."..`.(.l..j.V..@._....Hz.y..$......l..wqn.-.?..Z[..I....}...:........+........G.';......})..y......Htf?...QT^....^.s.o....HuA....~..]W]z....H.jG.6.."...e..I..0.c&V'.`.(.5._..g.... ..(.)...Q.....K..o..LBm.(......^....\|TO.....u../.ks....H. .rQ.x.g.....O..!.H.C.@...B...!...V.....@.@..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\2176

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2201370221507448
Encrypted:	false
SSDEEP:	96:Hy4rDX8GmE5+46rJI28I647ZmHG1bowY:HyW8GmE5+46WI9oHGd
MD5:	216E98E6653132A09E72C162C03E78B9
SHA1:	ED1263FB16C098B60736761DE1F254BAFCF6FD88
SHA-256:	356F42381C7EFB39FF6494691CDE3EFA553DD0EBEE7C4915AEE89BBD9F84597C
SHA-512:	89D01C27D2625EFD174ADFFCB8C9E2F2A1AF6E710C08A7D790C3397AC8E78A5BE5A70585E8D3C4A5CBA5FF2B05BBAA2D71801522D5A686B5C556EB59A4C9B7D7
Malicious:	false
Preview:	........87........'..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4268

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2805549726147198
Encrypted:	false
SSDEEP:	96:mi9rB9L8GPVnh7gv6tzwQ8A9eEZ7ZnHG1bow4:miXd8G9nh7gv6wA9zNdHGd
MD5:	6CC107C01841C506E45724ED44EEA1A2
SHA1:	4B0C577E0209F0E0C78D926ECDD118139EB16551
SHA-256:	ADFCA216E568E8C75B72964DF2F36216DF603ECAE201A3986273415292836E04
SHA-512:	28E40F5F99E1B99D213593D3C54A94AF0F7EF6CD4B8B6AFD715645D5774AB34B6360B06ACEB164534CA919CF233E04BCA3DE1255D846421D2039A55C7EE21B4E
Malicious:	false
Preview:	........(9.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Preview:	........................................J2SE.

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.463749485074333
Encrypted:	false
SSDEEP:	3:QRE2J5xAIMMEI3sXW9:Qi23fMa2S
MD5:	1D18400A60A480C0CC14E3A3F6747CEB
SHA1:	0A73F17CF65BE907BDDAA126697F9B263B6274E6
SHA-256:	6BE832C42EEAEA1F3BF5DBA8363641B2D485C308245E824D8C2EFB7179B6720C
SHA-512:	21EF3F67F1450246A61C3DC863E42893E8FFE5015FFFE8E32AE3568D57BB3C4568282D9A4F12E73120DC0D990F0224992688B450D1BDAFCFE9A45900F341B946
Malicious:	false
Preview:	cd .\AppData\Local\Temp\..gci .jar -Recurse..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5442
Entropy (8bit):	3.9401741588372845
Encrypted:	false
SSDEEP:	48:VLye9YchCsU2WlSVukvjwohSgS/brRAqQTSogZopfbrRAqiWTSogZoN1:0evhCNZl7kvMMSJbrRpjHWbrRpoHu
MD5:	649AF5CF97C397FE2D07254064044EE2
SHA1:	A3BAA8B7A6AE21BE4BBF49F73EE4EC00B534BF1C
SHA-256:	8C4AA67F553041B6B88F0007C771EC3FA8357C8074CC143297EB34FBC6D70EB7
SHA-512:	7971DDBBCD71BFA6B77DF89044DBBD2A74BB0FC52C1041D1DDA6304C3B873B291D6F42ACC634FF50F7CC24B900DE0D42CC19B78639596F147E286DAAE7670129
Malicious:	false
Preview:	...................................FL..................F. .. ......9...a.R..b..z.:{.............................:..DG..Yr?.D..U..k0.&...&......&..9....=.;.Y....S..b......t...CFSF..1.....FWtM..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FWtM)Z)].....Y.....................?@.A.p.p.D.a.t.a...B.V.1.....FW.M..Roaming.@......FWtM)Z)].....Y......................Z.R.o.a.m.i.n.g.....\.1.....)Z+]..MICROS~1..D......FWtM)Z3].....Y........................M.i.c.r.o.s.o.f.t.....V.1.....GX.v..Windows.@......FWtM)Z)].....Z....................`e..W.i.n.d.o.w.s.......1.....FWvM..STARTM~1..n......FWtM)Z)].....Z..............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FWnN..Programs..j......FWtM)Z)].....Z..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FWtM)ZC].....Z....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FWtM)ZC]....PZ..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J0MAQF03DJQWUDMZA42R.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5442
Entropy (8bit):	3.9401741588372845
Encrypted:	false
SSDEEP:	48:VLye9YchCsU2WlSVukvjwohSgS/brRAqQTSogZopfbrRAqiWTSogZoN1:0evhCNZl7kvMMSJbrRpjHWbrRpoHu
MD5:	649AF5CF97C397FE2D07254064044EE2
SHA1:	A3BAA8B7A6AE21BE4BBF49F73EE4EC00B534BF1C
SHA-256:	8C4AA67F553041B6B88F0007C771EC3FA8357C8074CC143297EB34FBC6D70EB7
SHA-512:	7971DDBBCD71BFA6B77DF89044DBBD2A74BB0FC52C1041D1DDA6304C3B873B291D6F42ACC634FF50F7CC24B900DE0D42CC19B78639596F147E286DAAE7670129
Malicious:	false
Preview:	...................................FL..................F. .. ......9...a.R..b..z.:{.............................:..DG..Yr?.D..U..k0.&...&......&..9....=.;.Y....S..b......t...CFSF..1.....FWtM..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FWtM)Z)].....Y.....................?@.A.p.p.D.a.t.a...B.V.1.....FW.M..Roaming.@......FWtM)Z)].....Y......................Z.R.o.a.m.i.n.g.....\.1.....)Z+]..MICROS~1..D......FWtM)Z3].....Y........................M.i.c.r.o.s.o.f.t.....V.1.....GX.v..Windows.@......FWtM)Z)].....Z....................`e..W.i.n.d.o.w.s.......1.....FWvM..STARTM~1..n......FWtM)Z)].....Z..............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FWnN..Programs..j......FWtM)Z)].....Z..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FWtM)ZC].....Z....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FWtM)ZC]....PZ..........

C:\Users\user\Downloads\5cc79d3e-11f2-45d3-81f3-99c7e047c108.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\8bd6dfcc-92bf-4e1d-9f13-f65d1ac49963.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\MT103 Mansourbank (1).zip (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	true
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\MT103 Mansourbank (1).zip.crdownload (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\MT103 Mansourbank.zip (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	true
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\MT103 Mansourbank.zip.crdownload (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\Swift Mansourbank.zip (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	true
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\Swift Mansourbank.zip.crdownload (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

C:\Users\user\Downloads\d3f3b3e3-7f33-4119-88a5-9cac2852313d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	90538
Entropy (8bit):	7.996560816389903
Encrypted:	true
SSDEEP:	1536:CctHOUelXYd5SMmHP/kXoqQX+gF3I07VBdfTAFn/10aV2tBa0n1s/EuW5Ug8esmU:CBUioE/k4qQXJFZ7VfMl/CaUt401s8uX
MD5:	B661F233D51065512C459FE4FFF2F681
SHA1:	223950762C28B29851F413D0A18D5506D0B924D3
SHA-256:	2FF081A8ED1CC91D4C1B1478027BFB40A0A504871FBDAD8821ACC8D089754439
SHA-512:	068C07CD319B4ED0658D3C1505FDA7EC5D0401A705D810CF0B27F43A38BE5A1A63CF14C96C78F0CF8C6A7F3E38D87143E932A7B59E133E291FEAF99D1B58781A
Malicious:	false
Preview:	PK..........%Z................Swift Transactions/PK........W.%Zh...2`..8.......Swift Transactions/Swift Transaction Report.js\....%.}7..N........$@xAw...d0........:..:.....UYiG.<~..;.]...G.c.......\|wO..FS......7.........9.g.;..]..O^<.......R..B....vy..8.l...i.....VV.!,.$...H.?.K..3.s......e..Xx....7...p.o..p...L].E...X.`Gj.S++}..N.Z...........M..^%..K.p9.#>".(X.W.....7.hI.4....&....?<......G..Z:.W.G.a=g..E{.[...\|)[q.....8....^.v@f4..z.8....^..9n.$..`..,b...^[...f..R..{.f..=.,7.....N?......MUF..7.w.N..K.......Cx..d).....".b\N.....Q......M9....7n..V....c.....\.R.............q]..O.}3.g..@.a.+<.zQN..;y0.n....\|..Z...Qv.al.B.S...N\|.a.?....N.......<..z...}U...C..,.........k.)......}.6..\...;.^..9K.P+....9.......F..[3i.o.n..@`j.EA:.~. .(..`...#..1TO.c`w.EjJ.o...h.t.U>0a{g.1...=X.R.^.r..]o........=.yy....Y..laC...@...v..v...=3...x..Pj......^.j..~..x....MI..N.j..B.d}O.~..+.s......~.................lc.e..5..M2..X..2....R.f...\|.3M..8.....)T.)Z*t..N7.

\Device\ConDrv

Download File

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	140
Entropy (8bit):	5.1030619724035935
Encrypted:	false
SSDEEP:	3:CEuXWN0LdmI3VuEHNekOCe3Z8md3EIFHgtzasVVdR1Ikk1:CEuX8jIcCQ93EHt+sVVCF1
MD5:	67923EB5173B4A81DD4F8954EFCF4BDF
SHA1:	F3780A75AE4B391060BB8A953B7A4A3632E2B0AE
SHA-256:	46ED3C9741B74886F805C491E189983FBE21E9B50907514A2D7069DF1D130BBF
SHA-512:	A5CC6BA075EEE88BEDA940337BEE99A65F78D81C7E5F07A559EC7F90F14AC2C5BEF31BFE986B666FC0D3E8EF4F4E7C92EF947545F16EE5E825499D07B49201CE
Malicious:	false
Preview:	java version "1.8.0_381"..Java(TM) SE Runtime Environment (build 1.8.0_381-b09)..Java HotSpot(TM) Client VM (build 25.381-b09, mixed mode)..

Static File Info

General

File type:	SVG Scalable Vector Graphics image
Entropy (8bit):	6.057265090020272
TrID:
File name:	Swift-TT680169 Report.svg
File size:	127'905 bytes
MD5:	ccc997a94272656e267c53bde3bc895b
SHA1:	34f412909bdd36f3f5fa6ae5f9e70d56b9f182af
SHA256:	3d44de6a6a5358af68357af152c958173369fd96dc2ce4cae03c26795f4d8e8d
SHA512:	dff751dbb628b5452de9cc7669e343d6b940c64a69aa094fe0d527dbfc18ef005a713d24ed9d45f52e85bb96f3a666af53b6c2858c3d2b39757876047556203b
SSDEEP:	3072:bO0yJEw9N/Tay87YvHLJ+8MLpxlLkeCbAv8iHtsqbOxjf2LCZzY:S0L4o7SM8+pxlJOA06bNLCW
TLSH:	49C302724604053CF110A6489A4B2CF49FBC709B650B9CE1754E29D77B8EFD6AC67ACC
File Content Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 600">. Background -->. <rect x="0" y="0" width="800" height="600" fill="#f9f9f9"/>.. Header -->. <defs>. <linearGradient id="headerGradient" x1="0%" y1="0%" x2="0%" y2="

File Icon


Icon Hash:	0703053232670f1f

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 12:43:22.956348896 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:23.165201902 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:23.381165981 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:23.829173088 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:24.697112083 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:26.393177032 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:29.941164017 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:35.828898907 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:36.041450024 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:36.257210970 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:36.693173885 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:36.853142977 CET	443	49690	204.79.197.200	192.168.2.17
Jan 9, 2025 12:43:36.903810024 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:37.113209963 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:37.329178095 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:37.557220936 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:37.753206968 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:38.617161989 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:39.257205009 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:40.313200951 CET	443	49700	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:42.741173029 CET	443	49698	40.126.31.67	192.168.2.17
Jan 9, 2025 12:43:43.765197039 CET	443	49700	40.126.31.67	192.168.2.17

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 12:42:51.257173061 CET	138	138	192.168.2.17	192.168.2.255

Target ID:	0
Start time:	06:41:36
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:41:37
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=1704,i,11278545449151701423,6029193152170411620,262144 /prefetch:3
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:41:37
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\Desktop\Swift-TT680169 Report.svg
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:41:37
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:3
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:41:39
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:41:40
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:41:56
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-GB --service-sandbox-type=collections --mojo-platform-channel-handle=4972 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:41:56
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4068 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:42:04
Start date:	09/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff711290000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	06:42:04
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	06:42:23
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:42:26
Start date:	09/01/2025
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff7a4ba0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:42:36
Start date:	09/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_MT103 Mansourbank (1).zip\Swift Transactions\Swift Transaction Report.js"
Imagebase:	0x7ff7fe2c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: 0000001B.00000002.1774863969.0000018ECEB80000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: 0000001B.00000003.1762756522.0000018ECE56B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: 0000001B.00000002.1773858739.0000018ECE575000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:42:37
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7224 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	06:42:38
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
Imagebase:	0xfb0000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:42:38
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:42:38
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0xac0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:42:38
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:42:38
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:\Users\user\AppData\Local\Temp\Swift Confirmation Copy.jar"
Imagebase:	0xf10000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: 00000021.00000003.1727597847.0000000000BC4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BranchlockObfuscator, Description: Yara detected Branchlock Obfuscator, Source: 00000021.00000002.1746647087.00000000048E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:42:39
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist.exe
Imagebase:	0x420000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:42:39
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:43:16
Start date:	09/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=3228 --field-trial-handle=1984,i,14423018754843558300,1982035588700509442,262144 /prefetch:8
Imagebase:	0x7ff729830000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 028CD9A5 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

`pml, xrefs: 028CDAC5

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c2000_java.jbxd

Similarity

API ID:
String ID: `pml
API String ID: 0-3670309078
Opcode ID: 7be3f2cdd2d4943f735c29ac4adb84e4139ef57076ceee97eeeec8911c0458b8
Instruction ID: 49aec1d26c82cdaa55e803b25a1850e2a127aba7f6d367532709b969cdd9750a
Opcode Fuzzy Hash: 7be3f2cdd2d4943f735c29ac4adb84e4139ef57076ceee97eeeec8911c0458b8
Instruction Fuzzy Hash: D98188BDA04601DFDB18EF24C594BA9F7B1FB49314F2481ADD81A8B381CB34E845CB91

Function 028C0672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc755a5d929067e63bff56e08df5e436612951e0b25e9b603560b6bab973cbdc
Instruction ID: 664049dc9dae00e7ae5db7ff0da880572b8c2b841a434b7682aec0104fdc9e9c
Opcode Fuzzy Hash: fc755a5d929067e63bff56e08df5e436612951e0b25e9b603560b6bab973cbdc
Instruction Fuzzy Hash: 1F11517AD0422ADFCF14DF48C4869ADB7B0FB59354F254529DC69E3741D334A920CB91

Function 028C0722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd1e8e6e1409d6ac9a34ef841611287a4703767fe1c488c3a4b960eb5b5720d
Instruction ID: b261409e06954bfabca6798633829ee4490f5edf863040c9508144d9e5a795b0
Opcode Fuzzy Hash: 8fd1e8e6e1409d6ac9a34ef841611287a4703767fe1c488c3a4b960eb5b5720d
Instruction Fuzzy Hash: F3F01C7EC00229DB8B14DF44C5400ADF771EB04218B29849ADC2C77641D332AD51CF81

Function 028D4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3122c1f08c68bd941209b3baa34b79a27a2aaca17cd4707c427910b4e5dab9de
Instruction ID: da6b980f7c6ef923a21ac0c88e03a2bf599cf225cbe71c75669f4b5232f2f52b
Opcode Fuzzy Hash: 3122c1f08c68bd941209b3baa34b79a27a2aaca17cd4707c427910b4e5dab9de
Instruction Fuzzy Hash: 75F07FB5900A06EBDB15CF65C4047DAFBB4BB88718F15421AD42C57350D778B4658BC1

Function 028CDA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f87ea1856f998e54158e196c39d3c08b0a55b11925334a5abed03daede458c1
Instruction ID: 49f0e015aefc0b84c3f7e6959e19d10e5321425a9f4fe6fc7ff83bbf67460aba
Opcode Fuzzy Hash: 1f87ea1856f998e54158e196c39d3c08b0a55b11925334a5abed03daede458c1
Instruction Fuzzy Hash: 95F0C2B6D00A06EBDB24CF65C4047DAFBB5BB84714F15421AC42C67310D378B465CBC0

Function 028D3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d03a16dfed959caa9685952942b717911ef7b7822e86e4740d7b975aa4c3779
Instruction ID: 8892f11233cfe20b0000ed154da3c93543d0dd4f73e1fa01256b807b344c6172
Opcode Fuzzy Hash: 4d03a16dfed959caa9685952942b717911ef7b7822e86e4740d7b975aa4c3779
Instruction Fuzzy Hash: 0CF0C2BAD00A06EBDB24CF65C4047CAFBB4BB84714F15421AC42C67310D378B465CBC0

Function 028D45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c2000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa91cd1d197d6af68c1c1adfcbfc27cc2a7226ac92ed195cea331a6d34809713
Instruction ID: 1a6192edd895e17563367e0415bf0a7a4cf191982fe754e26f97fcd96e2985a2
Opcode Fuzzy Hash: fa91cd1d197d6af68c1c1adfcbfc27cc2a7226ac92ed195cea331a6d34809713
Instruction Fuzzy Hash: DDF0C2B6D00A06EBDB24CF65C4047CAFBB5BB84714F15421AC52C67310D378B465CBC0

Non-executed Functions

Function 028C03C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1724250247.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_28c0000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: c5e63333239de3933147aa0e153a5facfbe84f54a371db861db22f2796f2aaa7
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 172117BA5042568FDB358F188C407D9B7E5FB08354F21892EDECDEB710D330AA898B50

Analysis Process: javaw.exePID: 4268, Parent PID: 7720COMMON

Executed Functions

Function 0282D8F7 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

`pml, xrefs: 0282DAC5

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID: `pml
API String ID: 0-3670309078
Opcode ID: a226bd74ee6b08336215188c964b464faba588124943d73158e421f256debde0
Instruction ID: e22b5536d8c86ed0eda4015f7bbf5eae9a9107a20b6bae1484df33858d940b8f
Opcode Fuzzy Hash: a226bd74ee6b08336215188c964b464faba588124943d73158e421f256debde0
Instruction Fuzzy Hash: 16A1AE7DA04611DFEB18CF24C494BA9FBB1FF49318F14819DD81A9B381C774A889CB91

Function 0282D8D1 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

`pml, xrefs: 0282DAC5

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID: `pml
API String ID: 0-3670309078
Opcode ID: 43ed079e79ad11b8ee714d68979638e4424155529ea7f4c87de48f39e5f686e0
Instruction ID: 5f58c1843e3f73060af4ee40584405a5e77bc61d5faff1d6e30df180dfbce1ba
Opcode Fuzzy Hash: 43ed079e79ad11b8ee714d68979638e4424155529ea7f4c87de48f39e5f686e0
Instruction Fuzzy Hash: ED71DD79604651DFEB18CF24C894BAAFBB1FF49314F18819DD81A9B381C774A889CF91

Function 028CFB92 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa5407ba523d0a97f82d56a26288b49ff92af47b1dee5b1ce2c948b9873d04c
Instruction ID: c1b9c37e3f1416974873fc244363f9dc62bf6e8875898278b42d99114462f817
Opcode Fuzzy Hash: 7aa5407ba523d0a97f82d56a26288b49ff92af47b1dee5b1ce2c948b9873d04c
Instruction Fuzzy Hash: FBD11979A083008FD715DF18D08061ABBE2FF99314F65C9AEE989DB755C735E842CB82

Function 028D9227 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fad30b034385120864acbab16c10a864c018a52ba5b706141ba7bce755a2e44
Instruction ID: 9f058c23435f48456d081bd5746f23d6584397e1efedac36f26a169160799a3b
Opcode Fuzzy Hash: 3fad30b034385120864acbab16c10a864c018a52ba5b706141ba7bce755a2e44
Instruction Fuzzy Hash: 6E31DDB8A09746EFD719CF20C4093A9BBB0BB42308F0985ADC85CA7781D734695DCBC2

Function 02820672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2820000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc755a5d929067e63bff56e08df5e436612951e0b25e9b603560b6bab973cbdc
Instruction ID: c93f00177fe7f83eb4927621074a76d04a6fb68aedceadfd0541fcd942dfaa7c
Opcode Fuzzy Hash: fc755a5d929067e63bff56e08df5e436612951e0b25e9b603560b6bab973cbdc
Instruction Fuzzy Hash: AB118EBAD0023ACFCF14DF48C8864ADB3B0FBA9314B154525DC69E3342D335A9A4CB81

Function 028D2A68 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de8bb0270e2098945160ff9d50dbefd02b15585982bdffff7fc3f6912fa4faa
Instruction ID: 57380df49db38f2d4f0c84c5448b9eecb0dd1fe6c79d1d94d8c5c6114c2bdc08
Opcode Fuzzy Hash: 2de8bb0270e2098945160ff9d50dbefd02b15585982bdffff7fc3f6912fa4faa
Instruction Fuzzy Hash: EDF0E2798083888BC311AB348C45528BFB0BF17220F194BCDE8E4E72C3D322845ACB52

Function 028D2A90 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25d701683cf9d03ebd0134f3337eadbc680c55bc8ee1051f0644c75d06ae3f9
Instruction ID: 9a70a4705c4661d2a4f57d6d3193e05a089e8c207e5047b9808c4e3ac50279e6
Opcode Fuzzy Hash: f25d701683cf9d03ebd0134f3337eadbc680c55bc8ee1051f0644c75d06ae3f9
Instruction Fuzzy Hash: F2D05E79804208CBC200BF38D841529BBA4BF55324F594B8DECDCE7285E732A8818FA2

Function 02820722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002820000.00000040.00000800.00020000.00000000.sdmp, Offset: 02820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2820000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd1e8e6e1409d6ac9a34ef841611287a4703767fe1c488c3a4b960eb5b5720d
Instruction ID: d9b347ad6cac8894ed71d7375e06e7145115815aa723060fdfa46d58f2f8b589
Opcode Fuzzy Hash: 8fd1e8e6e1409d6ac9a34ef841611287a4703767fe1c488c3a4b960eb5b5720d
Instruction Fuzzy Hash: 9CF0157EC00229DFCB14DF48C4400ADF7B1EB14218B2A8496DC2CB7642D332ADA6CF81

Function 02834B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385fc8cb98ef85cf1b9764b80f70c07d93586debabd23fb5dd7a0edda163d24c
Instruction ID: 6f83ee260f48fade77eef390e5157d4e7d9cacd4db36cd4d4fa4854c4fcfcd13
Opcode Fuzzy Hash: 385fc8cb98ef85cf1b9764b80f70c07d93586debabd23fb5dd7a0edda163d24c
Instruction Fuzzy Hash: FCF07FB5900A16EBDB258F65C4047DAFBB4BB88718F15421AD42C57350D77874698BC1

Function 02836495 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ebd50b4872c1b98dcdc3e3ac98e2dc91c5c24f12a4c955a4dd876b54218e578
Instruction ID: c21499dfe1ecfb3c01e9e665b1fd5e90d0c4dd50084727024f7a2e1c03b2525a
Opcode Fuzzy Hash: 7ebd50b4872c1b98dcdc3e3ac98e2dc91c5c24f12a4c955a4dd876b54218e578
Instruction Fuzzy Hash: 59F09BBAA00B16EBDB25CF65C4047CAFBB4BB88714F15421AC42C67350D778B469CBC0

Function 0282EC1C Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812542801d71e56aa421aeb3b5096866f2ecf0b2af453c36b2389997e931d4f7
Instruction ID: 5eaee395654d450df826240ee449f97410765364f63bbf3a0769f79b528766de
Opcode Fuzzy Hash: 812542801d71e56aa421aeb3b5096866f2ecf0b2af453c36b2389997e931d4f7
Instruction Fuzzy Hash: D3F092B5900B16EBDB25CF65C4047DAFBB4BB88714F15421AC42C67750D7787469CBC0

Function 0282DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d528cd2d73e4f01d53a0cfd6280c43a9a37122aa47c9dd5048cf6e4533aeb950
Instruction ID: 28fb9aeac183f67fd5e86b635aee23317e81ecbd7d474adacc236497ef50c15e
Opcode Fuzzy Hash: d528cd2d73e4f01d53a0cfd6280c43a9a37122aa47c9dd5048cf6e4533aeb950
Instruction Fuzzy Hash: 3AF0C2B6D00A16EBDB248F65C4047DAFBB5BB84714F15421AC42C67310D3787469CBC0

Function 028349AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90de1ebaf40a289bf2c9a204a44986a0ce14992a23db9c78d92c0aa5b972346
Instruction ID: c5395c7ed94ba58c8afd9867fb00d6ff08c67a88d0623fd4af3807a41ddb6e72
Opcode Fuzzy Hash: b90de1ebaf40a289bf2c9a204a44986a0ce14992a23db9c78d92c0aa5b972346
Instruction Fuzzy Hash: C0F0C2BAD00A16EBDB248F65C4047CAFBB4BB88714F15421AC42C6B310D7787469CBC0

Function 0282DE6E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c7065e776ac863d2f120be8d53c62d2555cf7f56ab59978fd2807e27d1322d
Instruction ID: 7965b59b83c25e34828d5b2cfd57dba0cc28740d76125a5fa1c99a9c80f744d1
Opcode Fuzzy Hash: 21c7065e776ac863d2f120be8d53c62d2555cf7f56ab59978fd2807e27d1322d
Instruction Fuzzy Hash: D2F0CABAD00A16EBDB248F61C4047CAFBB4BB88714F15421AC42CA7720C778B4A9CBC0

Function 02833C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5a46e1aca097a8a8d197bfd87e66ac7cb54f884ddb05d1002be0a3116a3ae
Instruction ID: de20d8e984cfeff8d4e0a11fddd8e13e337b2c27ab78a43b4865cc147cf8aea4
Opcode Fuzzy Hash: 39f5a46e1aca097a8a8d197bfd87e66ac7cb54f884ddb05d1002be0a3116a3ae
Instruction Fuzzy Hash: 7DF0C2BAD00A16EBDB248F65C4047CAFBB4BB84714F15421AC42C67310D3787469CBC0

Function 028345E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.0000000002824000.00000040.00000800.00020000.00000000.sdmp, Offset: 02824000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2824000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c748fdc4f1d52ff20f4e7fe3efcc140a9c79c54315e41fbd8379661e932e2d
Instruction ID: 43352856579d0a334d8450fc69bb00013077467c3c90a505fb0159023c24dc9c
Opcode Fuzzy Hash: d9c748fdc4f1d52ff20f4e7fe3efcc140a9c79c54315e41fbd8379661e932e2d
Instruction Fuzzy Hash: 5EF0C2B6D00A16EBDB248F65C4047CAFBB5BB84714F15421AC52C67310D3787469CBC0

Non-executed Functions

Function 028C8C18 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9034e8664a129bec7e0b4748f9033cabfd587a3e2d11e9267d1ad6fcb508c7
Instruction ID: e2c50ca5dfdf11455eb91e1ee05d7c1a870ad73515a21bb0475bb683f36e8ff4
Opcode Fuzzy Hash: 8d9034e8664a129bec7e0b4748f9033cabfd587a3e2d11e9267d1ad6fcb508c7
Instruction Fuzzy Hash: A55170799443118FC751DF28C48062AF7F1BF99328F698A5DE898E7356D731E842CB82

Function 028CB4C4 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1745874428.00000000028C4000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_28c4000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b5e46fd764642a316965d621364c8f23013f227b3638614c770532d5f5935d
Instruction ID: 0ea5593834288e697568d0342c1ea793c34b8e77977ed71ae36b13fc7a76b4fa
Opcode Fuzzy Hash: 78b5e46fd764642a316965d621364c8f23013f227b3638614c770532d5f5935d
Instruction Fuzzy Hash: F531996648EBC64FD7435B709CAA2813FB09F13224B1A04DBC4C4CF5A3E6AD494EC762

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Swift-TT680169 Report.svg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03a8f6d2-06be-4efc-83cb-16948f075345.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\143320e0-b762-4142-b33d-4e80c44a3ad4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b4f5d21-8126-4dd9-87bc-4a82e148cbe2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2a409780-63d2-495e-83f6-43ccf7f9f598.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\566b605b-6868-45cb-aca8-3a1e411d05e7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a16d7c6-47ac-4ed1-af29-259c6076f4de.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FB5F0-188C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677FB5F1-1990.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\086e0fa1-5907-4276-aeaa-8ee48f9b77af.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\236d95c9-171c-419e-b9d6-06c58a9c63ff.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\26128592-a8ef-4943-bb36-46d9b02b808c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51705603-6cb4-4c1a-b73c-4cd7c444d23e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53d0b431-60d0-44cc-99ab-831818e2dc12.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\671d9ce1-49dc-43ae-bb82-bbd67603ee2b.tmp

Windows Analysis Report
Swift-TT680169 Report.svg