Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Suspicious Indicators 3

• Anti-Detection/Stealthyness
  • Possibly checks for the presence of an Antivirus engine

    details

    ""superantispyware.recurly.com"," (Indicator: "superantispyware") in Source: wallet-checkout-eligible-sites.json
    ""totaldefense.com"," (Indicator: "totaldefense") in Source: wallet-checkout-eligible-sites.json

    source

    File/Memory

    relevance

    3/10

    ATT&CK ID

    T1518.001 (Show technique in the MITRE ATT&CK™ matrix)

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ET DNS Query to a *.top domain - Likely Hostile" (SID: 2023883, Rev: 4, Severity: 2) categorized as "Potentially Bad Traffic"

    source

    Suricata Alerts

    relevance

    10/10

• Network Related
  • Found potential IP address in binary/memory

    details

    Potential IP "1.5.75.75" found in string "d="M10 2a8 8 0 110 16 8 8 0 010-16zm0 10.5a.75.75 0 100 1.5.75.75 0 000-1.5zM10 6a.5.5 0 00-.5.41v4.68a.5.5 0 001 0V6.41A.5.5 0 0010 6z""
    Potential IP "192.168.1.3" found in string ""192.168.1.3","
    Potential IP "192.168.1.1" found in string ""192.168.1.1","

    source

    File/Memory

    relevance

    3/10

    ATT&CK ID

    T1071 (Show technique in the MITRE ATT&CK™ matrix)

• Informative 12

• External Systems
  • Detected Suricata Alert

    details

    Detected alert "ET INFO Microsoft Connection Test" (SID: 2031071, Rev: 4, Severity: 3) categorized as "Misc activity"

    source

    Suricata Alerts

    relevance

    10/10

  • Sample was identified as clean by Antivirus engines

    details

    0/78 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Contacts server

    details

    "104.19.136.100:443"
    "138.91.254.96:443"
    "104.18.200.68:443"
    "104.17.25.14:443"
    "104.16.57.101:443"
    "104.18.218.46:443"
    "104.18.7.225:443"
    "89.187.187.20:443"
    "23.62.46.17:443"
    "89.187.187.9:443"
    "66.254.114.171:443"
    "104.18.101.40:443"
    "213.174.157.105:443"
    "74.117.182.34:443"
    "172.64.175.26:443"
    "104.18.51.106:443"
    "172.64.106.29:443"
    "209.197.3.25:443"
    "208.99.84.23:443"

    source

    Network Traffic

    relevance

    1/10

    ATT&CK ID

    T1071 (Show technique in the MITRE ATT&CK™ matrix)

  • Creates mutants

    details

    "SM0:7656:304:WilStaging_02"
    "Local\SM0:7656:304:WilStaging_02"
    "InternetShortcutMutex"
    "SM0:7656:120:WilError_01"
    "Local\SM0:7656:120:WilError_01"

    source

    Created Mutant

    relevance

    3/10

  • Found a reference to a known community page

    details

    Found string ""baysidebuddy.com"," (Indicator: "ebuddy.com"; File: "wallet-pre-stable.json")
    Found string ""comeherebuddy.com"," (Indicator: "ebuddy.com"; File: "wallet-pre-stable.json")
    Found string ""www.facebook.com"," (Indicator: "facebook.com"; File: "wallet-pre-stable.json")
    Found string ""linkedin.com"," (Indicator: "linkedin.com"; File: "wallet-pre-stable.json")
    Found string ""paypal.com"," (Indicator: "paypal"; File: "wallet-checkout-eligible-sites.json")
    Found string ""netflix.com"," (Indicator: "netflix.com"; File: "wallet-checkout-eligible-sites.json")
    Found string ""ads.twitter.com"," (Indicator: "twitter"; File: "wallet-checkout-eligible-sites.json")
    Found string ""ipnpb.paypal.com"," (Indicator: "paypal"; File: "wallet-checkout-eligible-sites.json")
    Found string ""youtube.com"," (Indicator: "youtube"; File: "wallet-checkout-eligible-sites.json")
    Found string ""developer.twitter.com"," (Indicator: "twitter"; File: "wallet-checkout-eligible-sites.json")
    Found string ""securepayments.paypal.com"," (Indicator: "paypal"; File: "wallet-checkout-eligible-sites.json")
    Found string ""payflowlink.paypal.com"," (Indicator: "paypal"; File: "wallet-checkout-eligible-sites.json")
    Found string ""tubebuddy.com"," (Indicator: "ebuddy.com"; File: "wallet-checkout-eligible-sites.json")
    Found string ""music.youtube.com"," (Indicator: "youtube"; File: "wallet-checkout-eligible-sites.json")

    source

    File/Memory

    relevance

    2/10

  • Queries DNS server

    details

    "a.adtng.com"
    "a.bestcontentfood.top"
    "api.edgeoffer.microsoft.com"
    "assets.sb-cd.com"
    "b-hls-18.doppiocdn.org"
    "b.bestcontentindustry.top"
    "bam.nr-data.net"
    "c.ptgncdn.com"
    "cbjpeg.stream.highwebmedia.com"
    "cdn3.bestcontentindustry.top"
    "cdnjs.cloudflare.com"
    "chaturbate.com"
    "creative.xlviirdr.com"
    "deliver.ptgncdn.com"
    "desire2do3675.spankbang.com"
    "edge-hls.doppiocdn.org"
    "edge11-sea.live.mmcdn.com"
    "fonts.googleapis.com"
    "fonts.gstatic.com"
    "go.xlviirdr.com"
    "hls-uranus.sb-cd.com"
    "ht-cdn2.adtng.com"
    "hw-cdn2.adtng.com"
    "img.strpst.com"
    "js-agent.newrelic.com"

    source

    Network Traffic

    relevance

    1/10

    ATT&CK ID

    T1071.004 (Show technique in the MITRE ATT&CK™ matrix)

• Installation/Persistence
  • Dropped files

    details

    "edge_driver.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%TEMP%\4660_438256467\edge_driver.js]- [targetUID: 00000000-00006260]
    "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00004660]
    "Ruleset Data" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir4660_1877046014\Ruleset Data]- [targetUID: 00000000-00004660]
    "wallet.bundle.js" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A]
    "wallet-stable.json" has type "ASCII text"- [targetUID: N/A]
    "wallet-pre-stable.json" has type "ASCII text"- [targetUID: 00000000-00004660]
    "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\4660_1210463552\recovery-component-inner.crx]- [targetUID: 00000000-00005724]
    "Filtering Rules" has type "data"- Location: [%TEMP%\4660_1281401267\Filtering Rules]- [targetUID: 00000000-00007880]
    "f_0004f9" has type "MPEG transport stream data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f9]- [targetUID: 00000000-00001512]
    "vendor.bundle.js" has type "ASCII text with very long lines"- [targetUID: N/A]
    "wallet-drawer.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A]
    "f_0004f8" has type "MPEG transport stream data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f8]- [targetUID: 00000000-00001512]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00006552]
    "bnpl.bundle.js" has type "UTF-8 Unicode text with very long lines"- Location: [%TEMP%\4660_438256467\bnpl\bnpl.bundle.js]- [targetUID: 00000000-00006260]
    "f_0004cf" has type "ISO Media MP4 Base Media v1 [IS0 14496-12:2003]"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cf]- [targetUID: 00000000-00001512]
    "wallet-checkout-eligible-sites.json" has type "ASCII text"- Location: [%TEMP%\4660_438256467\json\wallet\wallet-checkout-eligible-sites.json]- [targetUID: 00000000-00006260]
    "f_0004f7" has type "MPEG transport stream data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f7]- [targetUID: 00000000-00001512]
    "tokenized-card.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A]
    "f_0004f5" has type "JSON data"- [targetUID: N/A]
    "notification.bundle.js" has type "UTF-8 Unicode text with very long lines"- [targetUID: N/A]
    "619cfaaa-d99a-4dc4-bc64-f57f2486b02a.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 177865"- Location: [%TEMP%\619cfaaa-d99a-4dc4-bc64-f57f2486b02a.tmp]- [targetUID: 00000000-00007440]
    "load_statistics.db" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00004660]
    "f_0004dc" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004dc]- [targetUID: 00000000-00001512]
    "Filtering Rules-AA" has type "data"- Location: [%TEMP%\4660_1281401267\Filtering Rules-AA]- [targetUID: 00000000-00007880]
    "f_0004e7" has type "data"- [targetUID: N/A]
    "f_0004f2" has type "data"- [targetUID: N/A]
    "f_0004de" has type "data"- [targetUID: N/A]
    "notification_fast.bundle.js" has type "ASCII text with very long lines"- [targetUID: N/A]
    "f_0004f4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f4]- [targetUID: 00000000-00001512]
    "f_0004eb" has type "data"- [targetUID: N/A]
    "miniwallet.bundle.js" has type "ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\Mini-Wallet\miniwallet.bundle.js]- [targetUID: 00000000-00006260]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00001512]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00001512]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00001512]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00001512]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00001512]
    "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00004660]
    "f_0004f3" has type "MPEG transport stream data"- [targetUID: N/A]
    "f_0004da" has type "data"- [targetUID: N/A]
    "e901afe9-6e61-4e78-ac92-df2bcfdef0d6.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12332"- Location: [%TEMP%\e901afe9-6e61-4e78-ac92-df2bcfdef0d6.tmp]- [targetUID: 00000000-00000396]
    "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\4660_391702275\edge_autofill_field_data.json]- [targetUID: 00000000-00006992]
    "f_0004f6" has type "MPEG transport stream data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f6]- [targetUID: 00000000-00001512]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00001512]
    "f_0004d0" has type "RIFF (little-endian) data Web/P image"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d0]- [targetUID: 00000000-00001512]
    "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00007656]
    "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00001512]
    "wallet-checkout-eligible-sites-pre-stable.json" has type "ASCII text"- Location: [%TEMP%\4660_438256467\json\wallet\wallet-checkout-eligible-sites-pre-stable.json]- [targetUID: 00000000-00004660]
    "Session_13337081694522778" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13337081694522778]- [targetUID: 00000000-00004660]
    "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00004660]
    "f_0004c5" has type "data"- [targetUID: N/A]
    "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00004660]
    "safety_tips.pb" has type "data"- Location: [%TEMP%\4660_142541280\safety_tips.pb]- [targetUID: 00000000-00006128]
    "f_0004f0" has type "MPEG transport stream data"- [targetUID: N/A]
    "Tabs_13337081694933854" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13337081694933854]- [targetUID: 00000000-00004660]
    "980483c9-a6c1-4df3-834b-c0a4ff149f65.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\980483c9-a6c1-4df3-834b-c0a4ff149f65.tmp]- [targetUID: 00000000-00004660]
    "f_0004df" has type "data"- [targetUID: N/A]
    "3eed23f7-66d8-4352-8574-a8d93046c121.tmp" has type "JSON data"- [targetUID: N/A]
    "f_0004cc" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00001512]
    "f_0004d8" has type "data"- [targetUID: N/A]
    "Diagnostic Data-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\ru\strings.json]- [targetUID: 00000000-00006260]
    "ff50eca4b427d00b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ff50eca4b427d00b_0]- [targetUID: 00000000-00004660]
    "8d0a6f8c-8b0d-4094-8330-157f1ff10469.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\8d0a6f8c-8b0d-4094-8330-157f1ff10469.tmp]- [targetUID: 00000000-00004660]
    "7e607e6e-f2a6-4264-976c-07b1eeb40ef3.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\7e607e6e-f2a6-4264-976c-07b1eeb40ef3.tmp]- [targetUID: 00000000-00004660]
    "ac9784d8-2b10-41d2-b75f-15dbc6756e25.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ac9784d8-2b10-41d2-b75f-15dbc6756e25.tmp]- [targetUID: 00000000-00004660]
    "72ca78c7-0398-4080-989f-fb9b8c7d644e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\72ca78c7-0398-4080-989f-fb9b8c7d644e.tmp]- [targetUID: 00000000-00004660]
    "2d198ca3-e1c0-47af-ae83-87dd059602c6.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\2d198ca3-e1c0-47af-ae83-87dd059602c6.tmp]- [targetUID: 00000000-00004660]
    "d987d133-2086-43b2-a33e-8539f6f40fde.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d987d133-2086-43b2-a33e-8539f6f40fde.tmp]- [targetUID: 00000000-00004660]
    "5b5adf12-4caf-4f2d-82c6-0d69413acd89.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5b5adf12-4caf-4f2d-82c6-0d69413acd89.tmp]- [targetUID: 00000000-00004660]
    "958fe18e-97ae-43ab-9502-ab5d78c405a5.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\958fe18e-97ae-43ab-9502-ab5d78c405a5.tmp]- [targetUID: 00000000-00004660]
    "6acbbc4e-f5b0-441e-b2e3-f2c53ca17e1a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6acbbc4e-f5b0-441e-b2e3-f2c53ca17e1a.tmp]- [targetUID: 00000000-00004660]
    "9139bb30-2fc3-4da0-8398-f0a8b60ea99f.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\ar\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\ja\strings.json]- [targetUID: 00000000-00006260]
    "History-journal" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History-journal]- [targetUID: 00000000-00004660]
    "f_0004e4" has type "MPEG ADTS layer III v1 128 kbps 44.1 kHz Monaural"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004e4]- [targetUID: 00000000-00001512]
    "f_0004e5" has type "MPEG ADTS layer III v1 128 kbps 44.1 kHz Monaural"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004e5]- [targetUID: 00000000-00001512]
    "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\fr-CA\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\fr\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\de\strings.json]- [targetUID: 00000000-00006260]
    "f_0004d9" has type "data"- [targetUID: N/A]
    "fa744c8f-4dc9-43e1-9099-2606cb0fd5b2.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 13568"- Location: [%TEMP%\fa744c8f-4dc9-43e1-9099-2606cb0fd5b2.tmp]- [targetUID: 00000000-00008128]
    "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00006552]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\pt-PT\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\es\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\it\strings.json]- [targetUID: 00000000-00006260]
    "f_0004d4" has type "data"- [targetUID: N/A]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\pt-BR\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\nl\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\sv\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\id\strings.json]- [targetUID: 00000000-00006260]
    "f_0004ef" has type "GIF image data version 89a 70 x 80"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ef]- [targetUID: 00000000-00001512]
    "QuotaManager" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager]- [targetUID: 00000000-00004660]
    "HubApps Icons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps Icons]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\en-GB\strings.json]- [targetUID: 00000000-00006260]
    "f_0004d3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d3]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\zh-Hant\strings.json]- [targetUID: 00000000-00006260]
    "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00001512]
    "f_0004c7" has type "data"- [targetUID: N/A]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-hub\zh-Hans\strings.json]- [targetUID: 00000000-00006260]
    "f_0004dd" has type "data"- [targetUID: N/A]
    "f_0004e0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004e0]- [targetUID: 00000000-00001512]
    "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00004660]
    "f_0004d5" has type "data"- [targetUID: N/A]
    "checkoutdata.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\wallet\wallet-checkout\checkoutdata.json]- [targetUID: 00000000-00006260]
    "f_0004d2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d2]- [targetUID: 00000000-00001512]
    "f_0004f1" has type "Web Open Font Format (Version 2) TrueType length 37924 version 1.0"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004f1]- [targetUID: 00000000-00001512]
    "f_0004d7" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d7]- [targetUID: 00000000-00001512]
    "f_0004c6" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00001512]
    "f_0004d6" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004d6]- [targetUID: 00000000-00001512]
    "f_0004db" has type "data"- [targetUID: N/A]
    "f_0004e2" has type "MPEG ADTS layer III v1 128 kbps 44.1 kHz Monaural"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004e2]- [targetUID: 00000000-00001512]
    "f_0004e1" has type "data"- [targetUID: N/A]
    "Favicons-journal" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons-journal]- [targetUID: 00000000-00004660]
    "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Vpn Tokens]- [targetUID: 00000000-00004660]
    "9f0083c844a77834_0" has type "data"- [targetUID: N/A]
    "shopping_iframe_driver.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "f_0004d1" has type "data"- [targetUID: N/A]
    "d78ad72e-dfe8-427d-b208-6814c61e8c8c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\d78ad72e-dfe8-427d-b208-6814c61e8c8c.tmp]- [targetUID: 00000000-00004660]
    "f_0004c4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00001512]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00006552]
    "f_0004ce" has type "data"- [targetUID: N/A]
    "f_0004e3" has type "Audio file with ID3 version 2.3.0 contains:MPEG ADTS layer III v1 128 kbps 44.1 kHz Monaural"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004e3]- [targetUID: 00000000-00001512]
    "f_0004e8" has type "data"- [targetUID: N/A]
    "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\4660_1281401267\LICENSE]- [targetUID: 00000000-00007880]
    "wallet-tokenization-config.json" has type "ASCII text"- [targetUID: N/A]
    "edd5e9ed-5601-4c79-a21f-466be19b42b3.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\edd5e9ed-5601-4c79-a21f-466be19b42b3.tmp]- [targetUID: 00000000-00004660]
    "ef1785a3-c9e0-4e23-b95d-ac57a05904d4.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\ef1785a3-c9e0-4e23-b95d-ac57a05904d4.tmp]- [targetUID: 00000000-00004660]
    "be4d39af-9e34-4c1a-96f9-f4d3e7dad48f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\be4d39af-9e34-4c1a-96f9-f4d3e7dad48f.tmp]- [targetUID: 00000000-00004660]
    "119d66f1-80eb-49a2-8a63-dcb41a03d214.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\119d66f1-80eb-49a2-8a63-dcb41a03d214.tmp]- [targetUID: 00000000-00004660]
    "39906100-4166-4540-ab2e-0ff6d1eca8aa.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\39906100-4166-4540-ab2e-0ff6d1eca8aa.tmp]- [targetUID: 00000000-00004660]
    "f_0004ed" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ed]- [targetUID: 00000000-00001512]
    "e82fa083-7be7-418e-9102-1b5b949dc6e0.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "crl-set" has type "data"- Location: [%TEMP%\4660_1140849887\crl-set]- [targetUID: 00000000-00007496]
    "67ff1782-ca36-45e7-ba42-cbfa3a91abba.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "f_0004cb" has type "gzip compressed data max compression original size modulo 2^32 52916"- [targetUID: N/A]
    "super_coupon.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\wallet\super_coupon.json]- [targetUID: 00000000-00004660]
    "Shortcuts" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Shortcuts]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\ru\strings.json]- [targetUID: 00000000-00006260]
    "f_0004c3" has type "data"- [targetUID: N/A]
    "f_0004e6" has type "MPEG ADTS layer III v1 128 kbps 44.1 kHz Monaural"- [targetUID: N/A]
    "f_0004ee" has type "gzip compressed data from Unix original size modulo 2^32 61199"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ee]- [targetUID: 00000000-00001512]
    "f_0004ea" has type "JPEG image data JFIF standard 1.02 aspect ratio density 1280x1281 segment length 16 comment: "Lavc58.134.100" baseline precision 8 854x480 components 3"- [targetUID: N/A]
    "f_0004e9" has type "JPEG image data JFIF standard 1.02 aspect ratio density 1280x1281 segment length 16 comment: "Lavc58.134.100" baseline precision 8 854x480 components 3"- [targetUID: N/A]
    "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\ar\strings.json]- [targetUID: 00000000-00006260]
    "f_0004c9" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00001512]
    "f_0004cd" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "f_0004c8" has type "RIFF (little-endian) data Web/P image"- [targetUID: N/A]
    "heavy_ad_intervention_opt_out.db" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\ja\strings.json]- [targetUID: 00000000-00006260]
    "load-ec-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4660_438256467\Wallet-Checkout\load-ec-i18n.bundle.js]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\fr-CA\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\fr\strings.json]- [targetUID: 00000000-00006260]
    "driver-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4660_438256467\driver-signature.txt]- [targetUID: 00000000-00006260]
    "WebAssistDatabase" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebAssistDatabase]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\de\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\pt-PT\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\es\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\it\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\pt-BR\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\nl\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\id\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\sv\strings.json]- [targetUID: 00000000-00006260]
    "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00004660]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\zh-Hant\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\en-GB\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-ec\zh-Hans\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- [targetUID: 00000000-00006260]
    "cc447452-b30e-463a-a13a-05fdb2099d66.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\cc447452-b30e-463a-a13a-05fdb2099d66.tmp]- [targetUID: 00000000-00001512]
    "bnpl_driver.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4660_438256467\bnpl_driver.js]- [targetUID: 00000000-00006260]
    "c0618159-3be5-4a9c-a8d2-d48685f62209.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c0618159-3be5-4a9c-a8d2-d48685f62209.tmp]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-shared-components\ja\strings.json]- [targetUID: 00000000-00006260]
    "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2]- [targetUID: 00000000-00004660]
    "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3]- [targetUID: 00000000-00004660]
    "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\ru\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-shared-components\zh-Hans\strings.json]- [targetUID: 00000000-00006260]
    "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00006552]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\ar\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\ja\strings.json]- [targetUID: 00000000-00006260]
    "mini-wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\de\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\en-GB\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-notification-shared\zh-Hans\strings.json]- [targetUID: 00000000-00006260]
    "notification_fast.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\Notification\notification_fast.html]- [targetUID: 00000000-00006260]
    "notification.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\Notification\notification.html]- [targetUID: 00000000-00004660]
    "1f08622e-1fa6-4ec3-824e-91b0e01ef0bc.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 16885"- Location: [%TEMP%\1f08622e-1fa6-4ec3-824e-91b0e01ef0bc.tmp]- [targetUID: 00000000-00008004]
    "5cd0f8d0-72e9-45ff-9458-2e7ca7b209c2.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\5cd0f8d0-72e9-45ff-9458-2e7ca7b209c2.tmp]- [targetUID: 00000000-00001512]
    "a4a506da-4302-4b72-a9aa-9393589509d1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a4a506da-4302-4b72-a9aa-9393589509d1.tmp]- [targetUID: 00000000-00001512]
    "ff677307-783b-49a6-86ae-e091d898a5ca.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\ff677307-783b-49a6-86ae-e091d898a5ca.tmp]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\ru\strings.json]- [targetUID: 00000000-00006260]
    "da6691a1-99ec-4974-b0cc-9e2a1c10e8a4.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "9a18b67d-1495-4f90-8198-e12856616f55.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\9a18b67d-1495-4f90-8198-e12856616f55.tmp]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\ar\strings.json]- [targetUID: 00000000-00006260]
    "deny_full_domains.list" has type "data"- Location: [%TEMP%\4660_1949884933\deny_full_domains.list]- [targetUID: 00000000-00004660]
    "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\4660_391702275\edge_autofill_global_block_list.json]- [targetUID: 00000000-00006992]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\ja\strings.json]- [targetUID: 00000000-00006260]
    "typosquatting_list.pb" has type "data"- Location: [%TEMP%\4660_142541280\typosquatting_list.pb]- [targetUID: 00000000-00006128]
    "47e9b7b5-0742-466a-9c33-97b869ef078c.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 12260"- Location: [%TEMP%\47e9b7b5-0742-466a-9c33-97b869ef078c.tmp]- [targetUID: 00000000-00006848]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\fr\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\de\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\pt-PT\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\nl\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\id\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\it\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\es\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\pt-BR\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\sv\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\en-GB\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\zh-Hans\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\zh-Hant\strings.json]- [targetUID: 00000000-00006260]
    "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00004660]
    "adblock_snippet.js" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4660_1281401267\adblock_snippet.js]- [targetUID: 00000000-00007880]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-tokenized-card\es\strings.json]- [targetUID: 00000000-00006260]
    "runtime.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "wallet-crypto.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\wallet-crypto.html]- [targetUID: 00000000-00004660]
    "wallet.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-tokenized-card\zh-Hant\strings.json]- [targetUID: 00000000-00006260]
    "wallet-drawer.html" has type "HTML document ASCII text with very long lines"- [targetUID: N/A]
    "vendor.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "wallet-drawer.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "verified_contents.json" has type "JSON data"- Location: [%TEMP%\4660_142541280\_metadata\verified_contents.json]- [targetUID: 00000000-00006128]
    "bnpl.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\bnpl\bnpl.bundle.js.LICENSE.txt]- [targetUID: 00000000-00006260]
    "tokenized-card.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\Tokenized-Card\tokenized-card.html]- [targetUID: 00000000-00006260]
    "bnpl.html" has type "HTML document ASCII text with very long lines"- Location: [%TEMP%\4660_438256467\bnpl\bnpl.html]- [targetUID: 00000000-00006260]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00006552]
    "load-hub-i18n.bundle.js" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]
    "tokenized-card.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt]- [targetUID: 00000000-00004660]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00006552]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\000003.log]- [targetUID: 00000000-00006552]
    "hub-signature.txt" has type "ASCII text with very long lines with no line terminators"- Location: [%TEMP%\4660_438256467\hub-signature.txt]- [targetUID: 00000000-00006260]
    "wallet-notification-config.json" has type "ASCII text"- [targetUID: N/A]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG]- [targetUID: 00000000-00006552]
    "deny_etld1_domains.list" has type "data"- Location: [%TEMP%\4660_1949884933\deny_etld1_domains.list]- [targetUID: 00000000-00004660]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00006552]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00006552]
    "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00004660]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension Scripts\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00006552]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG]- [targetUID: 00000000-00006552]
    "notification_fast.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\File System\Origins\LOG]- [targetUID: 00000000-00006552]
    "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00005600]
    "81662ada2251fa7c_0" has type "data"- [targetUID: N/A]
    "e80cf1cf0d8cd1e5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e80cf1cf0d8cd1e5_0]- [targetUID: 00000000-00004660]
    "91a0e917ad0abd1d_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\91a0e917ad0abd1d_0]- [targetUID: 00000000-00004660]
    "4672785f5b017f07_0" has type "data"- [targetUID: N/A]
    "58fa1b3e5c7e4630_0" has type "data"- [targetUID: N/A]
    "35468fcd151c96df_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\35468fcd151c96df_0]- [targetUID: 00000000-00004660]
    "8b081ea79d2e4b6a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8b081ea79d2e4b6a_0]- [targetUID: 00000000-00004660]
    "29733ac8896deccc_0" has type "data"- [targetUID: N/A]
    "4f0ba461d3a254a3_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4f0ba461d3a254a3_0]- [targetUID: 00000000-00004660]
    "9d8d468a6da17618_0" has type "data"- [targetUID: N/A]
    "c1eb9298af6cad0e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\c1eb9298af6cad0e_0]- [targetUID: 00000000-00004660]
    "ce109ec3368f324c_0" has type "data"- [targetUID: N/A]
    "a3918791611a29e4_0" has type "data"- [targetUID: N/A]
    "7f3b4434b10b106a_0" has type "data"- [targetUID: N/A]
    "bd4f545b6128b495_0" has type "data"- [targetUID: N/A]
    "9f9e38cff455e504_0" has type "data"- [targetUID: N/A]
    "3d93b918591c8cd0_0" has type "data"- [targetUID: N/A]
    "8c689325d360af82_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8c689325d360af82_0]- [targetUID: 00000000-00004660]
    "ae678fc5f684eaa4_0" has type "data"- [targetUID: N/A]
    "dc3e71bef044c721_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dc3e71bef044c721_0]- [targetUID: 00000000-00004660]
    "a4c008432b227523_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\a4c008432b227523_0]- [targetUID: 00000000-00004660]
    "ff5f14a0b15d690d_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ff5f14a0b15d690d_0]- [targetUID: 00000000-00004660]
    "4887119be0ef0ba1_0" has type "data"- [targetUID: N/A]
    "41a74cb0b39b7ed6_0" has type "data"- [targetUID: N/A]
    "b6ca4a0b779b491d_0" has type "data"- [targetUID: N/A]
    "f4ad00abcfb5f520_0" has type "data"- [targetUID: N/A]
    "57f33eadb94bbc0d_0" has type "data"- [targetUID: N/A]
    "a65e8ac1c37a1e61_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\a65e8ac1c37a1e61_0]- [targetUID: 00000000-00004660]
    "11041887b6de949b_0" has type "data"- [targetUID: N/A]
    "72949656bd434558_0" has type "data"- [targetUID: N/A]
    "12473002c482e146_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\12473002c482e146_0]- [targetUID: 00000000-00004660]
    "b8956917b2a37f2e_0" has type "data"- [targetUID: N/A]
    "26635f3284de4728_0" has type "data"- [targetUID: N/A]
    "bcf1fec46ce0de50_0" has type "data"- [targetUID: N/A]
    "c10ee2453bc5f714_0" has type "data"- [targetUID: N/A]
    "fbfa452dda6426e6_0" has type "data"- [targetUID: N/A]
    "0b317ec7dad584a6_0" has type "data"- [targetUID: N/A]
    "d9e73961eb77466f_0" has type "data"- [targetUID: N/A]
    "2d79308b2162bc08_0" has type "data"- [targetUID: N/A]
    "2dbfec56d75718f9_0" has type "data"- [targetUID: N/A]
    "59aedb2d918ff1ee_0" has type "data"- [targetUID: N/A]
    "2a6a087ab2b03f4a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2a6a087ab2b03f4a_0]- [targetUID: 00000000-00004660]
    "945dd6c970ccb041_0" has type "data"- [targetUID: N/A]
    "2341b670bba449c9_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2341b670bba449c9_0]- [targetUID: 00000000-00004660]
    "459283cbd7be647b_0" has type "data"- [targetUID: N/A]
    "e1868486655e9668_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\e1868486655e9668_0]- [targetUID: 00000000-00004660]
    "dad91cb57420d733_0" has type "data"- [targetUID: N/A]
    "84dc3aef7ee484b4_0" has type "data"- [targetUID: N/A]
    "29394e63847ab028_0" has type "data"- [targetUID: N/A]
    "d4a93d099cf27101_0" has type "data"- [targetUID: N/A]
    "2a789b778739bbd1_0" has type "data"- [targetUID: N/A]
    "6e7ffd4fef8cf5ef_0" has type "data"- [targetUID: N/A]
    "d3cc71bfed89f8d2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3cc71bfed89f8d2_0]- [targetUID: 00000000-00004660]
    "7221218eda7c7999_0" has type "data"- [targetUID: N/A]
    "d61f5ce137d943c6_0" has type "data"- [targetUID: N/A]
    "33ccd9b381238735_0" has type "data"- [targetUID: N/A]
    "3d9263b0da298a6b_0" has type "data"- [targetUID: N/A]
    "42f94c35a0fc8f1a_0" has type "data"- [targetUID: N/A]
    "c0675d1cbc6fd376_0" has type "data"- [targetUID: N/A]
    "bffd2bb9b4bd3e60_0" has type "data"- [targetUID: N/A]
    "23ea4334ba590c37_0" has type "data"- [targetUID: N/A]
    "3a1710a2ebfa9500_0" has type "data"- [targetUID: N/A]
    "9bc2ca6a0706b5da_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9bc2ca6a0706b5da_0]- [targetUID: 00000000-00004660]
    "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\4660_391702275\regex_patterns.json]- [targetUID: 00000000-00006992]
    "b18240c1a855d9aa_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b18240c1a855d9aa_0]- [targetUID: 00000000-00004660]
    "manifest.json" has type "JSON data"- Location: [%TEMP%\4660_1949884933\manifest.json]- [targetUID: 00000000-00007496]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\File System\Origins\000003.log]- [targetUID: 00000000-00006552]
    "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4660_1210463552\manifest.json]- [targetUID: 00000000-00007496]
    "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- [targetUID: 00000000-00007496]
    "crypto.bundle.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\crypto.bundle.js]- [targetUID: 00000000-00006260]
    "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00004660]
    "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\4660_391702275\manifest.json]- [targetUID: 00000000-00007496]
    "manifest.json" has type "JSON data"- Location: [%TEMP%\4660_1281401267\manifest.json]- [targetUID: 00000000-00007496]
    "manifest.json" has type "JSON data"- Location: [%TEMP%\4660_1140849887\manifest.json]- [targetUID: 00000000-00007496]
    "README.md" has type "ASCII text"- [targetUID: N/A]
    "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00004660]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log]- [targetUID: 00000000-00006552]
    "manifest.json" has type "JSON data"- Location: [%TEMP%\4660_142541280\manifest.json]- [targetUID: 00000000-00007496]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_1210463552\manifest.fingerprint]- [targetUID: 00000000-00004660]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_1140849887\manifest.fingerprint]- [targetUID: 00000000-00004660]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_391702275\manifest.fingerprint]- [targetUID: 00000000-00004660]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00004660]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\manifest.fingerprint]- [targetUID: 00000000-00004660]
    "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_1281401267\manifest.fingerprint]- [targetUID: 00000000-00004660]
    ".ses" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\.ses]- [targetUID: 00000000-00004660]
    "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001]- [targetUID: 00000000-00004660]
    "app-setup.js" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006260]
    "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log]- [targetUID: 00000000-00006552]
    "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\File System\Origins\000001.dbtmp]- [targetUID: 00000000-00004660]
    "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00004660]
    "strings.json" has type "ASCII text with no line terminators"- [targetUID: 00000000-00006260]
    "5998c6c7-ee49-45f5-a062-4c3206acbd10.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\5998c6c7-ee49-45f5-a062-4c3206acbd10.tmp]- [targetUID: 00000000-00004660]
    "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1]- [targetUID: 00000000-00001512]
    "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\scoped_dir4660_1877046014\LICENSE]- [targetUID: 00000000-00007880]
    "f_0004ec" has type "gzip compressed data from Unix original size modulo 2^32 61199"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ec]- [targetUID: 00000000-00001512]
    "f_0004ca" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00001512]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-mobile-hub\fr-CA\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "JSON data"- Location: [%TEMP%\4660_438256467\json\i18n-tokenized-card\fr-CA\strings.json]- [targetUID: 00000000-00006260]
    "notification.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "miniwallet.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt]- [targetUID: 00000000-00004660]
    "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00004660]
    "app-setup.js" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\app-setup.js]- [targetUID: 00000000-00006260]
    "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00004660]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\zh-Hant\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\ar\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\en-GB\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\de\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\nl\strings.json]- [targetUID: 00000000-00006260]
    "strings.json" has type "ASCII text with no line terminators"- Location: [%TEMP%\4660_438256467\json\i18n-notification\es\strings.json]- [targetUID: 00000000-00006260]

    source

    Binary File

    relevance

    3/10

    ATT&CK ID

    T1105 (Show technique in the MITRE ATT&CK™ matrix)

  • Drops a license file

    details

    "vendor.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "wallet-drawer.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "bnpl.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\bnpl\bnpl.bundle.js.LICENSE.txt]- [targetUID: 00000000-00006260]
    "tokenized-card.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt]- [targetUID: 00000000-00004660]
    "notification_fast.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "notification.bundle.js.LICENSE.txt" has type "ASCII text"- [targetUID: N/A]
    "miniwallet.bundle.js.LICENSE.txt" has type "ASCII text"- Location: [%TEMP%\4660_438256467\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt]- [targetUID: 00000000-00004660]

    source

    Binary File

    relevance

    1/10

    ATT&CK ID

    T1083 (Show technique in the MITRE ATT&CK™ matrix)

• Network Related
  • Contacts random domain names

    details

    "cdnjs.cloudflare.com" seems to be random
    "hls-uranus.sb-cd.com" seems to be random
    "report-uri.mmcdn.com" seems to be random
    "s3.cherry.tv" seems to be random
    "video.ktkjmp.com" seems to be random

    source

    Network Traffic

    relevance

    5/10

    ATT&CK ID

    T1071.001 (Show technique in the MITRE ATT&CK™ matrix)

  • Found mail related domain names

    details

    Observed email domain:""colourpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""aepop.net"," [Source: wallet-pre-stable.json]
    Observed email domain:""artpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""avenuepop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""bassettbmx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""canvasmx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""drinkolipop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""fashionfunpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""fastandloosebmx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""flitebmx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""fofopop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""gellipop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""gforcemx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""happipop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""hauzofpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""hiccapop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""hijabipop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""jellypop.la"," [Source: wallet-pre-stable.json]
    Observed email domain:""kinkbmx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""kloudkpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""knitpop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""kpop.exchange"," [Source: wallet-pre-stable.json]
    Observed email domain:""laperlamx.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""lovepop.com"," [Source: wallet-pre-stable.json]
    Observed email domain:""lullipop.com"," [Source: wallet-pre-stable.json]

    source

    File/Memory

    relevance

    1/10

    ATT&CK ID

    T1071.003 (Show technique in the MITRE ATT&CK™ matrix)

  • Found potential URL in binary/memory

    details

    Pattern match: "https://spankbang.com/s/japanese%20mother/"
    Pattern match: "https://spankbang.com"
    Pattern match: "https://spankbang.com/s/japanese%20mother"
    Pattern match: "r.Zc/J0c]3x7L}==awd`AD"
    Pattern match: "UE.QRd/9\lo?0H1^"
    Pattern match: "learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest"
    Pattern match: "https://spankbang.com/s/japanese%20mother/https://spankbang.comhttps://spankbang.com/s/japanese%20mother/https://spankbang.com/s/japanese%20mother/https://spankbang.comhttps://spankbang.comhttps://deliver.ptgncdn.comhttps://spankbang.comhttps://deliver.ptg"
    Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000"
    Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge"
    Pattern match: "ref.cherry.tv/scripts/sdk/everflow.jsthis"
    Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZ"
    Pattern match: "kL.kD/tlZL?/jDurz[ry:=VE08*#+^^MJv"
    Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed"
    Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#"
    Pattern match: "tsyndicate.com/defaulthttps://spankbang.com/defaulthttps://www.office.com/defaulthttps://ntp.msn.com/defaulttsyndicate.comspankbang.comwww.office.comntp.msn.comQ"
    Pattern match: "edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_search_light.png/1.3.4/asset9ce3c9c2-462f-4cc9-bbd7-57d656445be0https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_etree_light.png/1.1.9/asset8682d0fa-50b3-4ece-aa5b-e0b33f9919e2h"
    Pattern match: "www.clarity.msCLIDv10"
    Pattern match: "https://learn.microsoft.com/favicon.ico$Mhttps://www.bing.com/favicon.icohttps://spankbang.com/static/desktop/Images/icons/v3/favicon.ico@https://assets.msn.com/statics/icons/favicon_newtabpage.pnghttps://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981"
    Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZkNzctMWUxYi1lYWE2ZTU3ZTYzMzUmaW5zaWQ9NTE4Ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-"
    Pattern match: "https://*excel.officeapps.live.com/*,https://*onenote.officeapps.live.com/*,https://*powerpoint.officeapps.live.com/*,https://*word-edit.officeapps.live.com/*,https://*excel.partner.officewebapps.cn/*,https://*onenote.partner.officewebapps.cn/*,"
    Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A"
    Pattern match: "https://github.com/easylist"
    Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595"
    Pattern match: "https://www.coupert.com"
    Heuristic match: "SQLite format 3Wtableenabled_previews_v1enabled_previews_v1CREATE TABLE enabled_previews_v1 (type INTEGER NOT NULL, version INTEGER NOT NULL, PRIMARY KEY(type))ktablepreviews_v1previews_v1CREATE TABLE previews_v1 (host_name VARCHAR NOT NULL, time INTEGER N"
    Pattern match: "spankbang.com/s/japanese%20mother/Japanese"
    Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server"
    Pattern match: "http://www.w3.org/2000/svg,svg"
    Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U"
    Pattern match: "autofill.account.microsoft.com/,type"
    Pattern match: "1123movies.la/123moviess.la/3dmmgame.com/4playstation.com/aashingtonpost.com/adultdfriendfinder.com/aircananda.com/aks.ms/alaskaaair.com/alibabaa.com/alibbaba.com/alrecipes.com/ameritraade.com/answwers.com/arketwatch.com/ashshleyfurniture.com/ationalgeogra"
    Pattern match: "jedwatson.github.io/classnames"
    Pattern match: "https://github.com/focus-trap/tabbable/blob/master/LICENSE"
    Pattern match: "https://github.com/jsstyles/css-vendor"
    Pattern match: "assets.db/MANIFEST-0000012023/08/21-01:55:01.418"
    Pattern match: "static.cloudflareinsights.com/beacon.min.js/v8b253dfea2ab4077af8c6f58422dfbfd1689876627854"
    Pattern match: "lps.iluvestreaming.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js"
    Pattern match: "ref.cherry.tv/scripts/sdk/everflow.js"
    Pattern match: "assets.sb-cd.com/static/desktop/gen/universal.master.6.1.packed.player.v3.a7211eba.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/theatermode-react-7e01666220516bbe4f6c.js"
    Pattern match: "assets.sb-cd.com/static/desktop/gen/universal.master.6.1.packed.lozad.7de1c9ae.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/pages/models-4117e6704ae07f33.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/chatembed-prod-618fb5699431fe4cc223.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/N6w5XJENhnEXAGScc4rDO/_buildManifest.js"
    Pattern match: "assets.sb-cd.com/static/desktop/gen/universal.master.6.1.packed.sync.44b4ae0d.js"
    Pattern match: "chaturbate.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js"
    Pattern match: "assets.sb-cd.com/static/desktop/gen/universal.master.6.1.main.packed.22cd249b.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/runtime-react-400f99641068374534e4.js"
    Pattern match: "spankbang.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/runtime-prod-22cfbb8c72d95d4777ae.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/pages/_app-bba785f9ee3595c3.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/framework-79bce4a3a540b080.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/29107295-4a69275373f23f88.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/428-react-7da8cfffb197512b615f.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/webpack-e492080c1460dac8.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/681-react-c811f535a33e39eb1f3e.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/619-prod-8433445512200e6e8097.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/788-prod-769049592fd7f9fd42b5.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/746-prod-065967daec25dd7cba49.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/854-prod-402ae7ded9845ae9c021.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/635-prod-709b467edea14d63ce1c.js"
    Pattern match: "static-assets.highwebmedia.com/cachebust/61-react-af1a43b1f9d9251beb62.js"
    Pattern match: "js-agent.newrelic.com/page_view_timing-aggregate.7b2a53ee-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/page_view_event-aggregate.4988d952-1.237.1.min.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/main-a7fd6ff2f06d41d6.js"
    Pattern match: "lps.iluvestreaming.com/_next/static/chunks/7816-f2af6d83308d777e.js"
    Pattern match: "static-assets.highwebmedia.com/jsi18n/en/djangojs.js?hash=38df9dee7d2c"
    Pattern match: "js-agent.newrelic.com/session_trace-aggregate.ac30a1f3-1.237.1.min.js"
    Pattern match: "creative.xlviirdr.com/widgets/Spot/vendors~hls.ac6c6376a4f6d2484d91.js"
    Pattern match: "js-agent.newrelic.com/page_action-aggregate.467f8594-1.237.1.min.js"
    Pattern match: "hw-cdn2.adtng.com/delivery/intersection_observer/IntersectionObserver.js"
    Pattern match: "static-assets.highwebmedia.com/vendor/fingerprintjs-pro-cb.min.js"
    Pattern match: "js-agent.newrelic.com/lazy-feature-loader.c1052c27-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/jserrors-aggregate.319b8300-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/metrics-aggregate.b86cefcf-1.237.1.min.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.e1067846ea15.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.9b823bb2f723.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.a6262276739d.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.14a236a94bf9.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.97a5db11ca63.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.21e4d7885076.js"
    Pattern match: "static-assets.highwebmedia.com/CACHE/js/output.caee332d326d.js"
    Pattern match: "js-agent.newrelic.com/session-manager.d080e4cc-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/ajax-aggregate.d95c640e-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/spa-aggregate.550eec7b-1.237.1.min.js"
    Pattern match: "cdnjs.cloudflare.com/ajax/libs/video.js/7.18.1/video.min.js"
    Pattern match: "cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js"
    Pattern match: "js-agent.newrelic.com/async-api.e9f77430-1.237.1.min.js"
    Pattern match: "www.googletagmanager.com/gtag/js?id=G-2LDH4M9FT8"
    Pattern match: "ht-cdn2.adtng.com/delivery/vortex/vortex-simple-1.0.0.js"
    Pattern match: "js-agent.newrelic.com/860.95a91211-1.237.1.min.js"
    Pattern match: "js-agent.newrelic.com/646.9e7a6b8d-1.237.1.min.js"
    Pattern match: "spankbang.com/javascript/translation/51az/en.js"
    Pattern match: "creative.xlviirdr.com/widgets/Spot/lib.js"
    Pattern match: "a.bestcontentfood.top/warp/4786039?r=36466"
    Pattern match: "www.google-analytics.com/analytics.js"
    Pattern match: "lcdn.tsyndicate.com/sdk/v1/b.b.js"
    Pattern match: "deliver.ptgncdn.com/5a47a834.js"
    Heuristic match: "a.adtng.com"
    Heuristic match: "a.bestcontentfood.top"
    Heuristic match: "assets.sb-cd.com"
    Heuristic match: "b-hls-18.doppiocdn.org"
    Heuristic match: "b.bestcontentindustry.top"
    Heuristic match: "bam.nr-data.net"
    Heuristic match: "c.ptgncdn.com"
    Heuristic match: "cbjpeg.stream.highwebmedia.com"
    Heuristic match: "cdn3.bestcontentindustry.top"
    Heuristic match: "cdnjs.cloudflare.com"
    Heuristic match: "chaturbate.com"
    Heuristic match: "creative.xlviirdr.com"
    Heuristic match: "deliver.ptgncdn.com"
    Heuristic match: "desire2do3675.spankbang.com"
    Heuristic match: "edge-hls.doppiocdn.org"
    Heuristic match: "edge11-sea.live.mmcdn.com"
    Heuristic match: "fonts.googleapis.com"
    Heuristic match: "fonts.gstatic.com"
    Heuristic match: "go.xlviirdr.com"
    Heuristic match: "hls-uranus.sb-cd.com"
    Heuristic match: "ht-cdn2.adtng.com"
    Heuristic match: "hw-cdn2.adtng.com"
    Heuristic match: "img.strpst.com"
    Heuristic match: "js-agent.newrelic.com"
    Heuristic match: "lcdn.tsyndicate.com"
    Heuristic match: "lps.iluvestreaming.com"
    Heuristic match: "pxl.tsyndicate.com"
    Heuristic match: "realtime.pa.highwebmedia.com"
    Heuristic match: "ref.cherry.tv"
    Heuristic match: "report-uri.mmcdn.com"
    Heuristic match: "s3.cherry.tv"
    Heuristic match: "spankbang.com"
    Heuristic match: "static-assets.highwebmedia.com"
    Heuristic match: "static-pub.highwebmedia.com"
    Heuristic match: "static.cloudflareinsights.com"
    Heuristic match: "static.spankbang.com"
    Heuristic match: "stats.postgen.com"
    Heuristic match: "tb.sb-cd.com"
    Heuristic match: "tbi.sb-cd.com"
    Heuristic match: "tsyndicate.com"
    Heuristic match: "video.ktkjmp.com"
    Pattern match: "www.bing.com"
    Heuristic match: "xlivesex.com"
    Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,o=1;o"
    Pattern match: "http://www.w3.org/2000/svg"
    Pattern match: "http://www.w3.org/2000/svg};class"
    Pattern match: "www.klarna.com"
    Pattern match: "www.google.com"
    Pattern match: "www.gstatic.com"
    Pattern match: "www.transunion.com"
    Pattern match: "www.googletagmanager.com"
    Pattern match: "www.facebook.com"
    Pattern match: "www.googleadservices.com"
    Pattern match: "www.gap.com"
    Pattern match: "www.gapfactory.com"
    Pattern match: "www2.hm.com"
    Pattern match: "www.gapcanada.ca"
    Pattern match: "www2.factoryoutletstore.com"
    Pattern match: "www2.invoicecloud.com"
    Pattern match: "www1.ussailing.org"
    Pattern match: "www2.doggysuperfoods.com"
    Pattern match: "www1.agenciatributaria.gob.es"
    Pattern match: "www9.agenciatributaria.gob.es"
    Pattern match: "www.vaxvacationaccess.com"
    Pattern match: "www2.promap.co.uk"
    Pattern match: "www2.correios.com.br"
    Pattern match: "www2.stanlycountync.gov"
    Pattern match: "www2.registerblast.com"
    Pattern match: "www5.maine.gov"
    Pattern match: "www2.haircarerefined.com"
    Pattern match: "www2.tonyprotein.com"
    Pattern match: "www2.vinesse.com"
    Pattern match: "www5.ibackup.com"
    Pattern match: "www3.thedatabank.com"
    Pattern match: "www2.helminc.com"
    Pattern match: "www2.unifyhealthlabs.com"
    Pattern match: "www3.benefitsolver.com"
    Pattern match: "www1.nobexpartners.com"
    Pattern match: "www6.agenciatributaria.gob.es"
    Pattern match: "www2.kintsugihair.com"
    Pattern match: "www2.lectinblocker.com"
    Pattern match: "www1.hhrd.org"
    Pattern match: "www6.lifeatworkportal.com"
    Pattern match: "www3.mutualofomaha.com"
    Pattern match: "www3.masterwriter.com"
    Pattern match: "www1.carey.com"
    Pattern match: "www2.gundrymdtotalrestore.com"
    Pattern match: "www2.ymtvacations.com"
    Pattern match: "www2.invisicrepe.com"
    Pattern match: "www2.americanprofessional.com"
    Pattern match: "www2.ambrose.edu"
    Pattern match: "www1.netfirms.com"
    Pattern match: "www2.agenciatributaria.gob.es"
    Pattern match: "www1.12cloudpayroll.com"
    Pattern match: "www2.bwproducers.com"
    Pattern match: "www2.bhdpanama.com"
    Pattern match: "www2.fl-dcf.org"
    Pattern match: "www3.sylectus.com"
    Pattern match: "www1.iaproducers.com"
    Pattern match: "www1.mydomain.com"
    Pattern match: "www1.payroo.com"
    Pattern match: "www40.polyu.edu.hk"
    Pattern match: "www2.csebo.it"
    Pattern match: "www3.subcontrataley.cl"
    Pattern match: "www4.texashealth.org"
    Pattern match: "www2.drmartypets.com"
    Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,i=1;i"
    Pattern match: "https://aka.ms/EdgeSaveCardFAQ,gs.UseVirtualCardLearnMore=https://aka.ms/EdgeVirtualCardFAQ,gs.WalletSettings=edge://wallet/settings,gs.microsoftRewardsDashboardURL=https://rewards.microsoft.com/,gs.microsoftRewardsRedeemURL=https://rewards.microso"

    source

    File/Memory

    relevance

    3/10

    ATT&CK ID

    T1071 (Show technique in the MITRE ATT&CK™ matrix)

• Unusual Characteristics
  • Detected known bank URL artifact

    details

    ""4amscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""6whiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""99centsubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""allieandmickey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""alteregoscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""annabelbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com")
    ""aspirefashionscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""augustbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com")
    ""bananasmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""baseballmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""beautiiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""beautyandwhiskey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""bellagracehealthscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""belleandbubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""beyondblessedscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""blingbykey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""boosted-luckey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""bowlingmonkey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""burgeonbleu.com"," (Source: wallet-pre-stable.json, Indicator: "leu.com")
    ""busybeescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""cabbagekey.com"," (Source: wallet-pre-stable.json, Indicator: "key.com")
    ""coatsandscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""codenxtscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""cognitiontsscrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")
    ""concreterosescrubs.com"," (Source: wallet-pre-stable.json, Indicator: "ubs.com")

    source

    File/Memory

    relevance

    2/10

DNS Requests

Domain	Address	Registrar	Country
a.adtng.com OSINT Associated Artifacts for a.adtng.com Whois Field Value Address P.O. Box 81226 City Seattle Country US Creation Date 2018-07-20T16:37:50 DNSSEC unsigned Domain Name ADTNG.COM Domain Name adtng.com EMail registrar-abuse@amazon.com EMail registrar@amazon.com Expiration Date 2019-07-20T16:37:50 name On behalf of adtng.com owner Name Server NS-1343.AWSDNS-39.ORG Name Server ns-538.awsdns-03.net Organization Whois Privacy Service Reigstrar Amazon Registrar, Inc. State WA Status ok https://icann.org/epp#ok Status addPeriod https://icann.org/epp#addPeriod Last Update 2018-07-20T16:48:53 Last Update 2018-07-20T16:48:53.592000 Whois Server whois.registrar.amazon.com Zip Code 98108-1226	66.254.114.171 TTL: 12244	Amazon Registrar, Inc. Organization: Whois Privacy Service Name Server: NS-1343.AWSDNS-39.ORG Creation Date: 2018-07-20T16:37:50	United States
a.bestcontentfood.top OSINT Associated Artifacts for a.bestcontentfood.top Whois Field Value Address REDACTED FOR PRIVACY City REDACTED FOR PRIVACY Country REDACTED FOR PRIVACY Creation Date 2016-04-25T03:02:40 DNSSEC unsigned Domain Name bestcontentfood.top EMail abuse@key-systems.net EMail info@domain-contact.org Expiration Date 2020-04-25T03:02:40 name REDACTED FOR PRIVACY Name Server fred.ns.cloudflare.com Name Server olga.ns.cloudflare.com Organization REDACTED FOR PRIVACY Reigstrar Key-Systems GmbH State REDACTED FOR PRIVACY Status ok https://icann.org/epp#OK Status ok https://icann.org/epp#ok Last Update 2016-04-25T03:02:40 Whois Server whois.rrpproxy.net Zip Code REDACTED FOR PRIVACY	172.64.175.26 TTL: 300	Key-Systems GmbH Organization: REDACTED FOR PRIVACY Name Server: fred.ns.cloudflare.com Creation Date: 2016-04-25T03:02:40	United States
api.edgeoffer.microsoft.com OSINT Associated Artifacts for api.edgeoffer.microsoft.com Whois Field Value Address One Microsoft Way, City Redmond Country US Creation Date 1991-05-02T00:00:00 Creation Date 1991-05-01T21:00:00 DNSSEC unsigned Domain Name MICROSOFT.COM Domain Name microsoft.com EMail abusecomplaints@markmonitor.com EMail msnhst@microsoft.com Expiration Date 2021-05-03T00:00:00 Expiration Date 2021-05-02T21:00:00 name Domain Administrator Name Server NS1.MSFT.NET Name Server ns3.msft.net Organization Microsoft Corporation Referral URL http://www.markmonitor.com Reigstrar MarkMonitor, Inc. State WA Status clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited Status serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited) Last Update 2014-10-09T00:00:00 Last Update 2014-10-15T04:00:12 Whois Server whois.markmonitor.com Zip Code 98052	138.91.254.96 TTL: 1927	MarkMonitor, Inc. Organization: Microsoft Corporation Name Server: NS1.MSFT.NET Creation Date: 1991-05-02T00:00:00	United States
assets.sb-cd.com OSINT Associated Artifacts for assets.sb-cd.com Whois Field Value Address P.O. Box 0823-03411 City Panama Country PA Creation Date 2019-08-29T19:00:36 DNSSEC unsigned Domain Name SB-CD.COM Domain Name sb-cd.com EMail abuse@namecheap.com EMail bd126c60cb934dbd886ce3d928b82df6.protect@whoisguard.com Expiration Date 2020-08-29T19:00:36 name WhoisGuard Protected Name Server JONAH.NS.CLOUDFLARE.COM Name Server wally.ns.cloudflare.com Organization WhoisGuard, Inc. Reigstrar NAMECHEAP INC State Panama Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Last Update 2019-09-12T16:41:14 Last Update 0001-01-01T00:00:00 Whois Server whois.namecheap.com	104.18.218.46 TTL: 300	NAMECHEAP INC Organization: WhoisGuard, Inc. Name Server: JONAH.NS.CLOUDFLARE.COM Creation Date: 2019-08-29T19:00:36	United States
b-hls-18.doppiocdn.org OSINT Associated Artifacts for b-hls-18.doppiocdn.org Whois Field Value Address REDACTED FOR PRIVACY Address Kalkofnsvegur 2 City REDACTED FOR PRIVACY City Reykjavik Country IS Creation Date 2022-08-16T08:26:43 Creation Date 2022-08-16T08:26:43.840000 DNSSEC unsigned Domain Name doppiocdn.org EMail abuse@namecheap.com EMail d0b29ee870a94f9f8da7c570c8dc376f.protect@withheldforprivacy.com Expiration Date 2025-08-16T08:26:43 Expiration Date 2025-08-16T08:26:43.840000 name REDACTED FOR PRIVACY name Redacted for Privacy Name Server amy.ns.cloudflare.com Name Server duke.ns.cloudflare.com Organization Privacy service provided by Withheld for Privacy ehf Reigstrar NAMECHEAP INC State Capital Region Status ok https://icann.org/epp#ok Last Update 2022-08-21T08:26:57 Last Update 0001-01-01T00:00:00 Whois Server whois.namecheap.com Zip Code REDACTED FOR PRIVACY Zip Code 101	8.252.180.249 TTL: 189	NAMECHEAP INC Organization: Privacy service provided by Withheld for Privacy ehf Name Server: amy.ns.cloudflare.com Creation Date: 2022-08-16T08:26:43	United States
b.bestcontentindustry.top OSINT Associated Artifacts for b.bestcontentindustry.top Whois Field Value Address REDACTED FOR PRIVACY City REDACTED FOR PRIVACY Country REDACTED FOR PRIVACY Creation Date 2016-04-25T03:02:53 DNSSEC unsigned Domain Name bestcontentindustry.top EMail abuse@key-systems.net EMail info@domain-contact.org Expiration Date 2020-04-25T03:02:53 name REDACTED FOR PRIVACY Name Server fred.ns.cloudflare.com Name Server olga.ns.cloudflare.com Organization REDACTED FOR PRIVACY Reigstrar Key-Systems GmbH State REDACTED FOR PRIVACY Status ok https://icann.org/epp#OK Status ok https://icann.org/epp#ok Last Update 2016-04-25T03:02:53 Whois Server whois.rrpproxy.net Zip Code REDACTED FOR PRIVACY	172.64.106.29 TTL: 300	Key-Systems GmbH Organization: REDACTED FOR PRIVACY Name Server: fred.ns.cloudflare.com Creation Date: 2016-04-25T03:02:53	United States
bam.nr-data.net OSINT Associated Artifacts for bam.nr-data.net Whois Field Value Address 188 Spear St Suite 1200 City San Francisco Country US Creation Date 2014-04-11T00:00:00 Creation Date 2014-04-11T23:51:36 DNSSEC unsigned Domain Name NR-DATA.NET Domain Name nr-data.net EMail abuse@rebel.com EMail domain-admin@newrelic.com Expiration Date 2018-04-11T00:00:00 Expiration Date 2018-04-11T23:51:36 name Domain Administrator Name Server DNS1.P07.NSONE.NET Name Server ns3.p29.dynect.net Organization New Relic Referral URL http://www.rebel.com Reigstrar Rebel.com State CA Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Status CLIENT_UPDATE_PROHIBITED https://www.icann.org/epp#ClientUpdateProhibited Last Update 2017-02-13T00:00:00 Last Update 2017-02-13T17:34:13 Whois Server whois.Rebel.com Zip Code 94107	162.247.243.29 TTL: 3287	Rebel.com Organization: New Relic Name Server: DNS1.P07.NSONE.NET Creation Date: 2014-04-11T00:00:00	United States
c.ptgncdn.com OSINT Associated Artifacts for c.ptgncdn.com Whois Field Value Address P.O. Box 0823-03411 City Panama Country PA Creation Date 2019-10-31T16:44:36 DNSSEC unsigned Domain Name PTGNCDN.COM Domain Name ptgncdn.com EMail abuse@namecheap.com EMail 66ce800836f34324890d669dcb14f0ed.protect@whoisguard.com Expiration Date 2020-10-31T16:44:36 name WhoisGuard Protected Name Server JONAH.NS.CLOUDFLARE.COM Name Server wally.ns.cloudflare.com Organization WhoisGuard, Inc. Reigstrar NAMECHEAP INC State Panama Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Last Update 2019-10-31T17:10:36 Last Update 0001-01-01T00:00:00 Whois Server whois.namecheap.com	89.187.187.20 TTL: 300	NAMECHEAP INC Organization: WhoisGuard, Inc. Name Server: JONAH.NS.CLOUDFLARE.COM Creation Date: 2019-10-31T16:44:36	Czech Republic
cbjpeg.stream.highwebmedia.com OSINT Associated Artifacts for cbjpeg.stream.highwebmedia.com Whois Field Value Address PO Box 701 City San Mateo Country US Creation Date 2004-12-03T00:00:00 Creation Date 2004-12-03T07:57:07 DNSSEC unsigned Domain Name HIGHWEBMEDIA.COM EMail abuse@dynadot.com EMail privacy@dynadot.com Expiration Date 2018-12-03T00:00:00 Expiration Date 2018-12-03T07:57:07 name Domain Administrator c/o Dynadot Name Server CNS1.HIGHWEBMEDIA.COM Name Server cns2.highwebmedia.com Referral URL http://www.dynadot.com Reigstrar DYNADOT LLC State California Status clientTransferProhibited https://icann.org/epp#clientTransferProhibited Status clientTransferProhibited Last Update 2015-06-20T00:00:00 Last Update 2015-06-20T00:06:11 Whois Server whois.dynadot.com Zip Code 94401	131.153.81.176 TTL: 60	DYNADOT LLC Name Server: CNS1.HIGHWEBMEDIA.COM Creation Date: 2004-12-03T00:00:00	United States
cdn3.bestcontentindustry.top	172.64.106.29 TTL: 300	-	United States
cdnjs.cloudflare.com	104.17.25.14 TTL: 300	-	United States
chaturbate.com	104.18.101.40 TTL: 300	-	United States
creative.xlviirdr.com	104.18.59.150 TTL: 300	-	United States
deliver.ptgncdn.com	104.18.7.225 TTL: 300	-	United States
desire2do3675.spankbang.com	104.19.136.100 TTL: 300	-	United States
edge-hls.doppiocdn.org	8.252.72.121 TTL: 146	-	United States
edge11-sea.live.mmcdn.com	131.153.84.40 TTL: 300	-	United States
fonts.googleapis.com	142.250.189.170 TTL: 300	-	United States
fonts.gstatic.com	142.251.46.227 TTL: 86	-	United States
go.xlviirdr.com	104.18.59.150 TTL: 300	-	United States
hls-uranus.sb-cd.com	104.18.218.46 TTL: 300	-	United States
ht-cdn2.adtng.com	208.99.84.23 TTL: 21561	-	United States
hw-cdn2.adtng.com	209.197.3.25 TTL: 3247	-	United States
img.strpst.com	104.18.63.124 TTL: 300	-	United States
js-agent.newrelic.com	151.101.2.137 TTL: 20309	-	United States
lcdn.tsyndicate.com	8.252.188.249 TTL: 20	-	United States
lps.iluvestreaming.com	172.64.128.20 TTL: 300	-	United States
models-api.cherry-tv-marketing.workers.dev	104.21.61.219 TTL: 300	-	United States
pxl.tsyndicate.com	213.174.157.105 TTL: 21600	-	Netherlands
realtime.pa.highwebmedia.com	13.35.121.91 TTL: 300	-	United States
ref.cherry.tv	35.201.126.52 TTL: 300	-	United States
report-uri.mmcdn.com	104.16.92.18 TTL: 300	-	United States
s3.cherry.tv	104.16.13.94 TTL: 300	-	United States
spankbang.com	104.19.136.100 TTL: 300	-	United States
static-assets.highwebmedia.com	104.16.93.42 TTL: 300	-	United States
static-pub.highwebmedia.com	104.16.93.42 TTL: 300	-	United States
static.cloudflareinsights.com	104.16.57.101 TTL: 300	-	United States
static.spankbang.com	104.19.136.100 TTL: 300	-	United States
stats.postgen.com	74.117.182.34 TTL: 300	-	United States
tb.sb-cd.com	104.18.218.46 TTL: 300	-	United States
tbi.sb-cd.com	89.187.187.9 TTL: 300	-	Czech Republic
tsyndicate.com	213.174.157.105 TTL: 21600	-	Netherlands
video.ktkjmp.com	104.18.62.235 TTL: 300	-	United States
www.bing.com	23.62.46.17 TTL: 2472	-	United States
xlivesex.com	104.18.63.131 TTL: 300	-	United States

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
104.19.136.100 OSINT Associated Artifacts for 104.19.136.100 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 Threat Level no verdict Positives - Scan Date 04/12/2021 17:20:38 Reference AlienVault f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 no verdict - 04/12/2021 17:20:38 AlienVault Associated SHA256 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 Threat Level no verdict Positives - Scan Date 02/03/2021 11:05:16 Reference AlienVault 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 no verdict - 02/03/2021 11:05:16 AlienVault Associated SHA256 c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 Threat Level no verdict Positives - Scan Date 02/03/2021 10:36:42 Reference AlienVault c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 no verdict - 02/03/2021 10:36:42 AlienVault	443 TCP	msedge.exe PID: 1512	United States
138.91.254.96	443 TCP	msedge.exe PID: 1512	United States
104.19.136.100 OSINT Associated Artifacts for 104.19.136.100 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 Threat Level no verdict Positives - Scan Date 04/12/2021 17:20:38 Reference AlienVault f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 no verdict - 04/12/2021 17:20:38 AlienVault Associated SHA256 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 Threat Level no verdict Positives - Scan Date 02/03/2021 11:05:16 Reference AlienVault 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 no verdict - 02/03/2021 11:05:16 AlienVault Associated SHA256 c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 Threat Level no verdict Positives - Scan Date 02/03/2021 10:36:42 Reference AlienVault c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 no verdict - 02/03/2021 10:36:42 AlienVault	443 UDP	msedge.exe PID: 1512	United States
104.18.200.68 OSINT Associated Artifacts for 104.18.200.68 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 Threat Level no verdict Positives - Scan Date 04/12/2021 17:20:38 Reference AlienVault f767d360d6a2a3ca623eab3baf43381c88a3699ca3479a1bb07916d863502721 no verdict - 04/12/2021 17:20:38 AlienVault	443 TCP	msedge.exe PID: 1512	United States
104.17.25.14 OSINT Associated Artifacts for 104.17.25.14 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 996014cc38e0e98d274fbbb89e4f6ff92455e487e3a06ba46a38feb7c575a9d2 Threat Level no verdict Positives - Scan Date 07/31/2023 23:13:04 Reference AlienVault 996014cc38e0e98d274fbbb89e4f6ff92455e487e3a06ba46a38feb7c575a9d2 no verdict - 07/31/2023 23:13:04 AlienVault Associated SHA256 c54a1e795dc8c58df673e21133a794a63a1b3cc6fa2bb4ec36ddd1d3abdebcf9 Threat Level no verdict Positives - Scan Date 07/28/2023 11:29:28 Reference AlienVault c54a1e795dc8c58df673e21133a794a63a1b3cc6fa2bb4ec36ddd1d3abdebcf9 no verdict - 07/28/2023 11:29:28 AlienVault Associated SHA256 65c4341752fee166ebc5be118ee58b180ff037e633e775102149986ec1ae4fef Threat Level no verdict Positives - Scan Date 07/20/2023 18:43:22 Reference AlienVault 65c4341752fee166ebc5be118ee58b180ff037e633e775102149986ec1ae4fef no verdict - 07/20/2023 18:43:22 AlienVault Associated SHA256 67ff18a864630b8050d591e29d9a1237184e654be5098e37839aa8b01e59726d Threat Level no verdict Positives - Scan Date 07/20/2023 18:33:00 Reference AlienVault 67ff18a864630b8050d591e29d9a1237184e654be5098e37839aa8b01e59726d no verdict - 07/20/2023 18:33:00 AlienVault Associated SHA256 0a6bc68720b207b16c31de444c7eb04cde260297dd027d75b457cb57a51c94b0 Threat Level no verdict Positives - Scan Date 07/12/2023 04:03:09 Reference AlienVault 0a6bc68720b207b16c31de444c7eb04cde260297dd027d75b457cb57a51c94b0 no verdict - 07/12/2023 04:03:09 AlienVault	443 TCP	msedge.exe PID: 1512	United States
104.16.57.101 OSINT Associated Artifacts for 104.16.57.101 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 01919156db46549e8bf84801695e246e06dff0bd6137298148afa66993202bf3 Threat Level no verdict Positives - Scan Date 07/20/2023 15:41:50 Reference AlienVault 01919156db46549e8bf84801695e246e06dff0bd6137298148afa66993202bf3 no verdict - 07/20/2023 15:41:50 AlienVault Associated SHA256 32117fee79e4bb77fe2c3d3bc8549d4da40dfcf49ad04d190e73f2aa16ad0a29 Threat Level no verdict Positives - Scan Date 07/20/2023 15:36:42 Reference AlienVault 32117fee79e4bb77fe2c3d3bc8549d4da40dfcf49ad04d190e73f2aa16ad0a29 no verdict - 07/20/2023 15:36:42 AlienVault Associated SHA256 0f1b247c5010e7a19a415825e4c03fc42411b82b831a3086dad0640456114f2e Threat Level no verdict Positives - Scan Date 07/11/2023 23:19:09 Reference AlienVault 0f1b247c5010e7a19a415825e4c03fc42411b82b831a3086dad0640456114f2e no verdict - 07/11/2023 23:19:09 AlienVault Associated SHA256 22b36685ab094fa332ec60b26c3a9a678832458f18ed81ebec8ec78b1487d04f Threat Level no verdict Positives - Scan Date 07/11/2023 01:43:26 Reference AlienVault 22b36685ab094fa332ec60b26c3a9a678832458f18ed81ebec8ec78b1487d04f no verdict - 07/11/2023 01:43:26 AlienVault Associated SHA256 67a962b0bcfa26c0ae626a08491c328f4d5b14a74816a92c281a1d3576ee29de Threat Level no verdict Positives - Scan Date 07/10/2023 09:59:55 Reference AlienVault 67a962b0bcfa26c0ae626a08491c328f4d5b14a74816a92c281a1d3576ee29de no verdict - 07/10/2023 09:59:55 AlienVault	443 TCP	msedge.exe PID: 1512	United States
104.18.218.46 OSINT Associated Artifacts for 104.18.218.46 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 Threat Level no verdict Positives - Scan Date 02/03/2021 11:05:16 Reference AlienVault 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 no verdict - 02/03/2021 11:05:16 AlienVault Associated SHA256 c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 Threat Level no verdict Positives - Scan Date 02/03/2021 10:36:42 Reference AlienVault c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 no verdict - 02/03/2021 10:36:42 AlienVault	443 TCP	msedge.exe PID: 1512	United States
104.18.7.225	443 TCP	msedge.exe PID: 1512	United States
89.187.187.20 OSINT Associated Artifacts for 89.187.187.20 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 f30a4dba032bb9ea376c7d640ffe0ea5176507854cb0c3e36de2186be1de771a Threat Level no verdict Positives - Scan Date 01/09/2023 16:12:15 Reference AlienVault f30a4dba032bb9ea376c7d640ffe0ea5176507854cb0c3e36de2186be1de771a no verdict - 01/09/2023 16:12:15 AlienVault Associated SHA256 3cf3fb63e1f088211282c8ccff2975e2318f13ca87825589416d58a0efa9bed6 Threat Level no verdict Positives - Scan Date 07/11/2022 16:37:45 Reference AlienVault 3cf3fb63e1f088211282c8ccff2975e2318f13ca87825589416d58a0efa9bed6 no verdict - 07/11/2022 16:37:45 AlienVault Associated SHA256 1b49f1e3e487a663bf28174fdfce963fbeb29d60acfb34de172b17573c2339f0 Threat Level no verdict Positives - Scan Date 07/11/2022 16:31:48 Reference AlienVault 1b49f1e3e487a663bf28174fdfce963fbeb29d60acfb34de172b17573c2339f0 no verdict - 07/11/2022 16:31:48 AlienVault Associated SHA256 101f6d0e86abbecd51b20a0d0bac851f125725b961537a9b7d8a00a5a19c0e96 Threat Level no verdict Positives - Scan Date 01/11/2022 09:13:41 Reference AlienVault 101f6d0e86abbecd51b20a0d0bac851f125725b961537a9b7d8a00a5a19c0e96 no verdict - 01/11/2022 09:13:41 AlienVault Associated SHA256 db43d7e3ec678a43822c39549f8bc5afa767b210d6a0f30d4376a82e02d5dbac Threat Level no verdict Positives - Scan Date 01/11/2022 09:10:29 Reference AlienVault db43d7e3ec678a43822c39549f8bc5afa767b210d6a0f30d4376a82e02d5dbac no verdict - 01/11/2022 09:10:29 AlienVault	443 TCP	msedge.exe PID: 1512	Czech Republic
104.18.218.46 OSINT Associated Artifacts for 104.18.218.46 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 Threat Level no verdict Positives - Scan Date 02/03/2021 11:05:16 Reference AlienVault 173d802c790b712987024aed360012b943dd63d5fd326d657b1633d1d20d4174 no verdict - 02/03/2021 11:05:16 AlienVault Associated SHA256 c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 Threat Level no verdict Positives - Scan Date 02/03/2021 10:36:42 Reference AlienVault c1509028dd7c4c355ef72a9a9a19cdbce7f546849449701f5b0b3a7bf2d72a07 no verdict - 02/03/2021 10:36:42 AlienVault	443 UDP	msedge.exe PID: 1512	United States
23.62.46.17	443 TCP	msedge.exe PID: 1512	United States
23.62.46.17	443 UDP	msedge.exe PID: 1512	United States
104.18.7.225	443 UDP	msedge.exe PID: 1512	United States
89.187.187.9	443 TCP	msedge.exe PID: 1512	Czech Republic
66.254.114.171	443 TCP	msedge.exe PID: 1512	United States
104.18.101.40 OSINT Associated Artifacts for 104.18.101.40 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e4eeb26810b34d35a22c88eac852f2335f65e1e0c9c93f4ec312dc891e2fe053 Threat Level no verdict Positives - Scan Date 12/16/2020 06:41:06 Reference AlienVault e4eeb26810b34d35a22c88eac852f2335f65e1e0c9c93f4ec312dc891e2fe053 no verdict - 12/16/2020 06:41:06 AlienVault	443 TCP	msedge.exe PID: 1512	United States
213.174.157.105	443 TCP	msedge.exe PID: 1512	Netherlands
74.117.182.34 OSINT Associated Artifacts for 74.117.182.34 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 c9d804749c7b2f69650fa5a238c13235fcdc0d9e13f8a56ea3e45025fb85e709 Threat Level no verdict Positives - Scan Date 06/13/2022 18:09:52 Reference AlienVault c9d804749c7b2f69650fa5a238c13235fcdc0d9e13f8a56ea3e45025fb85e709 no verdict - 06/13/2022 18:09:52 AlienVault	443 TCP	msedge.exe PID: 1512	United States
172.64.175.26 OSINT Associated Artifacts for 172.64.175.26 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 a1954374b129c15dd5ccaae0962b6aeef01da11069abbfd5677b6150a95d0744 Threat Level no verdict Positives - Scan Date 02/02/2023 04:13:43 Reference AlienVault a1954374b129c15dd5ccaae0962b6aeef01da11069abbfd5677b6150a95d0744 no verdict - 02/02/2023 04:13:43 AlienVault	443 TCP	msedge.exe PID: 1512	United States
104.18.101.40 OSINT Associated Artifacts for 104.18.101.40 Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 e4eeb26810b34d35a22c88eac852f2335f65e1e0c9c93f4ec312dc891e2fe053 Threat Level no verdict Positives - Scan Date 12/16/2020 06:41:06 Reference AlienVault e4eeb26810b34d35a22c88eac852f2335f65e1e0c9c93f4ec312dc891e2fe053 no verdict - 12/16/2020 06:41:06 AlienVault	443 UDP	msedge.exe PID: 1512	United States
104.18.51.106	443 TCP	msedge.exe PID: 1512	United States
172.64.106.29	443 TCP	msedge.exe PID: 1512	United States
209.197.3.25	443 TCP	msedge.exe PID: 1512	United States
208.99.84.23	443 TCP	msedge.exe PID: 1512	United States
104.18.51.106	443 UDP	msedge.exe PID: 1512	United States
104.18.59.150	443 TCP	msedge.exe PID: 1512	United States
104.18.62.235	443 TCP	msedge.exe PID: 1512	United States
104.18.59.150	443 UDP	msedge.exe PID: 1512	United States
89.187.187.9	443 UDP	msedge.exe PID: 1512	Czech Republic
8.252.188.249	443 TCP	msedge.exe PID: 1512	United States
104.16.93.42	443 TCP	msedge.exe PID: 1512	United States
172.64.106.29	443 UDP	msedge.exe PID: 1512	United States
104.18.63.124	443 TCP	msedge.exe PID: 1512	United States
172.64.128.20	443 TCP	msedge.exe PID: 1512	United States
104.18.63.131	443 TCP	msedge.exe PID: 1512	United States
104.16.93.42	443 UDP	msedge.exe PID: 1512	United States
172.64.128.20	443 UDP	msedge.exe PID: 1512	United States
8.252.72.121	443 TCP	msedge.exe PID: 1512	United States
8.252.180.249	443 TCP	msedge.exe PID: 1512	United States
142.250.189.170	443 TCP	msedge.exe PID: 1512	United States
151.101.2.137	443 TCP	msedge.exe PID: 1512	United States
142.251.46.227	443 TCP	msedge.exe PID: 1512	United States
131.153.81.176	443 TCP	msedge.exe PID: 1512	United States
35.201.126.52	443 TCP	msedge.exe PID: 1512	United States
104.21.61.219	443 TCP	msedge.exe PID: 1512	United States
131.153.84.40	443 TCP	msedge.exe PID: 1512	United States
35.201.126.52	443 UDP	msedge.exe PID: 1512	United States
162.247.243.29	443 TCP	msedge.exe PID: 1512	United States
13.35.121.91	443 TCP	msedge.exe PID: 1512	United States
104.16.13.94	443 TCP	msedge.exe PID: 1512	United States
23.62.46.19	443 UDP	msedge.exe PID: 1512	United States
104.16.92.18	443 TCP	msedge.exe PID: 1512	United States
23.62.46.24	443 UDP	msedge.exe PID: 1512	United States
104.16.92.18	443 UDP	msedge.exe PID: 1512	United States

HTTP Traffic

No relevant HTTP requests were made.

Suricata Alerts