Edit tour

Windows Analysis Report
signatures0.xml

Overview

General Information

Sample Name:	signatures0.xml
Analysis ID:	1327929
MD5:	a4083556318e9b09f0f2788f6f5f8a03
SHA1:	b41d37adfd89abb634056e28ebe4dace74d247ed
SHA256:	4bb1653ebb174b389ce6d7c4bb63353d7559a8221a617cac8471ffc89059a5bd
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Maps a DLL or memory area into another process

Downloads suspicious files via Chrome

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Potential browser exploit detected (process start blacklist hit)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

MSOXMLED.EXE (PID: 3992 cmdline: C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\signatures0.xml MD5: A2E6E2A1C125973A4967540FD08C9AF0)

iexplore.exe (PID: 5756 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\signatures0.xml MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 6388 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5756 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 6824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 7224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2028,i,7214474149440342705,15663854153329362845,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 7200 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

msedge.exe (PID: 7440 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8540 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6060 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8688 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8288 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,4508265233850202264,6433900332490064734,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1988,i,11059177138448878817,363494266924799963,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: ghbmnnjooekpmoecnnnilnnbdlolhkhiX-Goog-Update-Updater: chromiumcrx-117.0.2045.47MS-CV: QrggOLjC9IOVJqFqwQLJvFSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0ZRyGerMMxu4RFOxsyDmj1TIzVUJ-HX4cuh-uDQ7uCVbGVAQkkn3C9KTFv-S8nSv57dZFrG0LMMWgtrGi2KXCy_oSWND4QFsKN1udZ1VWOBQk7pAMZSmuWoeRAitccu8TxzXMPjzesBqa0i2g/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_69_0_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/008b3ca9-659d-4158-b079-5522d9c1cce3?P1=1698229021&P2=404&P3=2&P4=aIH%2fa%2f%2f7gYGJMKlj4%2f4UGpwNK5e6Rk6%2bRmPewh%2bKvqeMiUI%2fe%2bGYJ4Og0HCgzisGwwGdd3miyKf3Dp1onfn%2bJQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ASH6akghPnLAXV9PRZ9Hm6Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir7440_1405436404\CRX_INSTALL\eventpage_bin_prod.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir7440_1405436404\CRX_INSTALL\page_embed_script.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir7440_1440446723\CRX_INSTALL\content.js	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	File dump: C:\Users\user\AppData\Local\Temp\scoped_dir7440_1440446723\CRX_INSTALL\content_new.js	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\signatures0.xml
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\signatures0.xml
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5756 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2028,i,7214474149440342705,15663854153329362845,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6060 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,4508265233850202264,6433900332490064734,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1988,i,11059177138448878817,363494266924799963,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\signatures0.xml	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5756 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=2043e	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=2028,i,7214474149440342705,15663854153329362845,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6060 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5884 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,4508265233850202264,6433900332490064734,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1988,i,11059177138448878817,363494266924799963,262144 /prefetch:3	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery

Jump to behavior

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF36DC6BC6D961E80B.TMP

Jump to behavior

Source: classification engine

Classification label: mal48.evad.winXML@57/259@10/7

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: Login Data.7.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdge.Stable_117.0.2045.47_neutral__8wekyb3d8bbwe\S-1-5-21-2246122658-3693405117-2476756634-1002.pckgdep target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: Joe Sandbox View	IP Address: 13.107.246.69 13.107.246.69
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: msapplication.xml1.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4d742322,0x01da01ac</date><accdate>0x4d768624,0x01da01ac</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml6.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4d7b49e5,0x01da01ac</date><accdate>0x4d7b49e5,0x01da01ac</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml8.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4d7dacf9,0x01da01ac</date><accdate>0x4d7dacf9,0x01da01ac</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml8.1.dr	String found in binary or memory: http://www.youtube.com/
Source: Network Persistent State0.7.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.7.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.7.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 6a849b6c-e9e4-49ce-97da-b25b8fca9254.tmp.8.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.7.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 6a849b6c-e9e4-49ce-97da-b25b8fca9254.tmp.8.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json.7.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.7.dr	String found in binary or memory: https://drive.google.com/
Source: 000003.log7.7.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: content_new.js.7.dr, content.js.7.dr	String found in binary or memory: https://www.google.com/chrome
Source: 6a849b6c-e9e4-49ce-97da-b25b8fca9254.tmp.8.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.7.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.7.dr	String found in binary or memory: https://www.office.com/Office

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	111 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	111 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
part-0041.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	Virustotal		Browse
https://chrome.cloudflare-dns.com/dns-query	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
part-0041.t-0009.t-msedge.net	13.107.246.69	true	false	0%, Virustotal, Browse	unknown
clients.l.google.com	142.251.2.100	true	false		high
googlehosted.l.googleusercontent.com	142.251.2.132	true	false		high
sni1gl.wpc.nucdn.net	152.195.19.97	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false		high
clients2.google.com	unknown	unknown	false		high

Name	Malicious	Antivirus Detection	Reputation
https://clients2.googleusercontent.com/crx/blobs/Acy1k0ZRyGerMMxu4RFOxsyDmj1TIzVUJ-HX4cuh-uDQ7uCVbGVAQkkn3C9KTFv-S8nSv57dZFrG0LMMWgtrGi2KXCy_oSWND4QFsKN1udZ1VWOBQk7pAMZSmuWoeRAitccu8TxzXMPjzesBqa0i2g/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_69_0_0.crx	false		high
https://chrome.cloudflare-dns.com/dns-query	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.69	part-0041.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	sni1gl.wpc.nucdn.net	United States	15133	EDGECASTUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.2.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.2.100	clients.l.google.com	United States	15169	GOOGLEUS	false

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.7.dr	false		high
https://chrome.cloudflare-dns.com	Network Persistent State0.7.dr	false	URL Reputation: safe	unknown
http://www.nytimes.com/	msapplication.xml4.1.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.7.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json.7.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.7.dr	false		high
https://www.office.com/Office	Top Sites.7.dr	false		high
http://www.amazon.com/	msapplication.xml.1.dr	false		high
http://www.twitter.com/	msapplication.xml6.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.7.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.7.dr	false		high
https://docs.google.com/	manifest.json.7.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.7.dr	false		high
https://www.google.com/chrome	content_new.js.7.dr, content.js.7.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json.7.dr	false		high
https://drive.google.com/	manifest.json.7.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json.7.dr	false		high
http://www.youtube.com/	msapplication.xml8.1.dr	false		high
https://chromewebstore.google.com/	manifest.json0.7.dr	false		high
http://www.wikipedia.com/	msapplication.xml7.1.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.7.dr	false		high
https://clients2.googleusercontent.com	6a849b6c-e9e4-49ce-97da-b25b8fca9254.tmp.8.dr	false		high
http://www.live.com/	msapplication.xml3.1.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.7.dr	false		high
http://www.reddit.com/	msapplication.xml5.1.dr	false		high
https://clients2.google.com	6a849b6c-e9e4-49ce-97da-b25b8fca9254.tmp.8.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json.7.dr	false		high
http://www.google.com/	msapplication.xml2.1.dr	false		high
https://drive-daily-3.corp.google.com/	manifest.json.7.dr	false		high

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1327929
Start date and time:	2023-10-18 12:16:05 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	signatures0.xml
Detection:	MAL
Classification:	mal48.evad.winXML@57/259@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xml

Time	Type	Description
11:17:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
11:17:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	FigmaSetup.exe	Get hash	malicious	BazaLoader	Browse
	FigmaSetup.exe	Get hash	malicious	BazaLoader	Browse
	https://pdfeditwithwave.com/	Get hash	malicious	Unknown	Browse
	Norriselectric-Paystub.Xhtml	Get hash	malicious	Unknown	Browse
	nunit.framework.xml	Get hash	malicious	Unknown	Browse
	Clear-cache.webp	Get hash	malicious	Unknown	Browse
	https://secure-esign.na1.echosign.com/public/esign?tsid=CBFCIBAA3AAABLblqZhAcC2jzf_nDlg4BQPbBBMkN41ozhbLg4utteRa_vKM-6oez0lkWC1feZM15QveBPgPaAGG_iIfPk_c8WHvLL9Xl&	Get hash	malicious	Unknown	Browse
	Clear-cache.webp	Get hash	malicious	Unknown	Browse
	PdfConverters.exe	Get hash	malicious	Unknown	Browse
	Certificado FNMT.rar	Get hash	malicious	Unknown	Browse
	Comprobante_de_transferencia_bancaria.pdf_.bAt.bat	Get hash	malicious	AsyncRAT, zgRAT	Browse
	rtahanan.zip	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2023-10-10T145447.708.eml	Get hash	malicious	Unknown	Browse
	pdf-mensal-688368525791-75.exe	Get hash	malicious	Unknown	Browse
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse
	Important cyeager@live-quinn.com Notification 10 6 2023 9 28 38 PM.eml	Get hash	malicious	Unknown	Browse
13.107.246.69	https://t.co/tr0IVi9Fmq	Get hash	malicious	Unknown	Browse
	ACH-receipt.html	Get hash	malicious	HTMLPhisher	Browse
	RemittanceCopy 1912INVOICE Tuesday.html	Get hash	malicious	Unknown	Browse
	http://reactivar.validavbrroutlook.mx.iceiy.com/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	Unknown	Browse
	https://pub-e155d29493854e57b8daf1867e6fc250.r2.dev/h1.html	Get hash	malicious	HTMLPhisher	Browse
	e-EFT027_e-Wire#.PDF.htm	Get hash	malicious	Unknown	Browse
	ACH Remittance Statement on October 17 2023 at 023544 AM.msg	Get hash	malicious	HTMLPhisher	Browse
	ACH Remittance Statement on October 17 2023 at 023544 AM.msg	Get hash	malicious	HTMLPhisher	Browse
	http://reactivar.validavbrroutlook.mx.iceiy.com/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	Unknown	Browse
	pJrhIhI9qo.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse
	C6F50CB47D61092240BC9E7FD6631451DDB617011AB03.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, RedLine, SmokeLoader	Browse
	Cozgpdk78a.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse
	woKNxlLX6g.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse
	oa4BkiTsU7.exe	Get hash	malicious	Unknown	Browse
	7tcxRpz1ZX.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse
	H0tbWlYwjx.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, RedLine, SmokeLoader	Browse
	kBFcD9h59A.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse
	wmPu4acz4r.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, RedLine, SmokeLoader	Browse
152.195.19.97	http://nieuws.onlinevoordelig.nl/public/read_message.jsp?tsp=1697465936696&custid=3752&uid=3914973526&sig=HIAIJLJBIHKMIBNC&mid=355422169&l=D0I5vlxi1I1sqvgwmI&slt=0	Get hash	malicious	Unknown	Browse
	Norriselectric-Paystub.Xhtml	Get hash	malicious	Unknown	Browse
	https://trk.klclick1.com/ls/click?upn=8Uo3rwZGyrZowFAXi8CbT00f5bMd82jpHWTK8cVpUOgpKYzbNJrHVjoh6LmtifH5RL6Klyu02S-2BY6HVXkpNc442-2FDMFwobQkjrhMM1dTgrWkkMSuoru3tQt64p9teVS-2B6jdHUnVnnAGxivP-2BNQZB6B4oBuXPYfJSNw08rwBvjA3iqcMgP-2FjK93Q9NE9xZHSwBGPNrPLZV-2BrPZGWOLFHmMYy6DI99q4Bk6cAWZp1JRJp-2BKMiBg8sCiA-2F8nHV0ViMCli0ECze1xfk3ivAEamQF0njU6f5K5SiqUT0gvGvSU0s-3DjxxS_cY66JaELm1bqa2cB6o7tKJT9FpSJGEZuU3Vd7U4tvz-2B1JM-2BW87OuehFK7i-2BHHskW0EnPE5yibgklGkw1Qg2GBU0F-2FafDWc5bNveAGOgEG3KpBSXt1sOuQyg17RiV7iE2C5HJrwN7wLWOCapRNxO-2FQgoh5okFZUEEHGvQlM7NaY-2F1o2eG454IlsI4gtTIM3-2Ffgo00n8rzMAbkkR2BuvYd-2BtHPQntW8bu-2F4Q9ZZbZ3fWh9-2B2LKqXFoMEVjBiEsIKCgphabDXCSb2-2BALaSsGd2fbr2vJoZgSYM4P3pesfvnmVJ-2F-2Bhu80sEzbbkThRDo5kCl1zHYE8w9OTlzhxlJ8eBpIwEbIzG9K37QMsdnpdXYDn8C2vpaa6tuLa0RSZeRVjhqONSkvXRNtjXnZBblzIDm1zj8M3U4FvwmXBxbL2PT7ah5xDTNqS1psgc3zHuVZS7pQPZIp03EvO5kF4Ue55GHfcKRuy-2Fy5MK6gWl-2Bp-2BoJg20-3D	Get hash	malicious	HTMLPhisher	Browse
	Email#INV-000614.html	Get hash	malicious	HTMLPhisher	Browse
	https://impservsys-my.sharepoint.com/:w:/p/hgreer/EWPUZkCHY81Km6A2lAUB8AMBdVLh6owpnl57R4Bau9_y7A?e=4%3aENVmFB&fromShare=true&at=9	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://lyonscsd-my.sharepoint.com/:o:/g/personal/ckuhn_lyonscsd_org/EnAKTsoHlqFMsCvLPZv-mfUBZriopsR2QarKuPK-0z3usQ?e=5%3aOdmo01&fromShare=true&at=9	Get hash	malicious	SharepointPhisher	Browse
	https://prevnorriswiener.buzz/?upvchldt=5a12353ccd3d7401e455caf869e2be4e3f97d2dba5932c529a0973c7a8dcc2474d0a8328072750c2179f8ae95f66a9d90b346b7380542f2cd4503bf980fb6295&qrc=undefined	Get hash	malicious	HTMLPhisher	Browse
	https://mfa-dept.org/MdGhvbWFzLmJlY2tAZmxjdS5vcmc=	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Certificado-_FNMT.exe	Get hash	malicious	GuLoader	Browse	52.123.249.142
	u8GfSAgFEO.elf	Get hash	malicious	Gafgyt	Browse	155.62.191.183
	https://t.co/tr0IVi9Fmq	Get hash	malicious	Unknown	Browse	13.107.246.69
	HFPhNWMpqK.elf	Get hash	malicious	Gafgyt	Browse	21.20.150.29
	vK0UDNFDD5.elf	Get hash	malicious	Gafgyt	Browse	191.232.237.246
	https://dl.grafana.com/enterprise/release/grafana-enterprise-10.1.5.windows-amd64.msi	Get hash	malicious	CobaltStrike	Browse	40.119.6.228
	ACH-receipt.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	m7Nwerq4Mz.elf	Get hash	malicious	Mirai	Browse	40.78.253.62
	FseQ36lw3F.elf	Get hash	malicious	Unknown	Browse	20.97.143.171
	RemittanceCopy 1912INVOICE Tuesday.html	Get hash	malicious	Unknown	Browse	13.107.213.69
	http://reactivar.validavbrroutlook.mx.iceiy.com/login.live.com_login_verify_credentials_outlook.html	Get hash	malicious	Unknown	Browse	13.107.213.69
	https://pub-e155d29493854e57b8daf1867e6fc250.r2.dev/h1.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://pub-0b366962715b4b8ca9b67a32dc218dbf.r2.dev/bendel.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://pub-65810deb44054180bb55f4f4d29d5339.r2.dev/pot.html	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	https://stellarpublic-my.sharepoint.com:443/:w:/g/personal/tash_stellarpublicrelations_com/Ed7GZBdZ2FRCigIXOX9rJpgB5QiMPNV0gZdNPHV2dSQtRQ?e=4%3ac5ZstF&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	52.108.8.12
	e-EFT027_e-Wire#.PDF.htm	Get hash	malicious	Unknown	Browse	13.107.213.71
	sora.mips.elf	Get hash	malicious	Mirai	Browse	20.232.88.229
	9TwoWV7laC.elf	Get hash	malicious	Mirai	Browse	13.95.88.204
	a5EUZjIppN.elf	Get hash	malicious	Mirai	Browse	40.127.55.1
	OwvZRqNcBz.elf	Get hash	malicious	Mirai	Browse	40.112.53.110
CLOUDFLARENETUS	ScanFatura001.exe	Get hash	malicious	AgentTesla	Browse	162.159.129.233
	Lf2xt30Jpm.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse	104.20.67.143
	NFtmtzpo95.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse	104.20.67.143
	https://protect-us.mimecast.com/s/xTSYCL92zRFRzQNEfg4b4c	Get hash	malicious	Unknown	Browse	104.21.95.117
	https://t.co/tr0IVi9Fmq	Get hash	malicious	Unknown	Browse	104.16.15.194
	PEDIDO_D45KG.PDF.exe	Get hash	malicious	AgentTesla	Browse	162.159.135.233
	WoDN7Q47dO.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	z9VzpR9Fmf.exe	Get hash	malicious	FormBook	Browse	172.67.181.92
	0bxAWA5e3x.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse	104.20.67.143
	IMG.00HJEIY_PRICE-QUOTE_SSG_0874087.exe	Get hash	malicious	FormBook	Browse	104.17.157.1
	Pre-alert_docs.exe	Get hash	malicious	Lokibot	Browse	104.21.4.159
	TqR53LgfMt.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.216.26
	ACH-receipt.html	Get hash	malicious	HTMLPhisher	Browse	172.67.210.78
	ySAFW9TLdc.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, RedLine, SmokeLoader	Browse	172.67.34.170
	qg3dE4bMBI.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse	104.20.67.143
	660361f776e3b878b6a925cccdfeccfd0d8152e4d98c6.exe	Get hash	malicious	Amadey, Babadeda, CobaltStrike, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse	104.20.67.143
	Updated_PI_&_BL_Draft.exe	Get hash	malicious	Lokibot	Browse	104.21.4.159
	http://mastermindset.net/k4f5	Get hash	malicious	HTMLPhisher	Browse	172.67.155.171
	saham.apk	Get hash	malicious	Irata	Browse	104.21.51.203
	saham.apk	Get hash	malicious	Irata	Browse	104.21.51.203
EDGECASTUS	https://protect-de.mimecast.com/s/cvx6CEqYQ6CnrX6juNTAm8	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	ACH-receipt.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	RemittanceCopy 1912INVOICE Tuesday.html	Get hash	malicious	Unknown	Browse	152.199.4.73
	Proposal P.O.0000004 for our new project.html	Get hash	malicious	HTMLPhisher	Browse	192.229.173.207
	https://pub-e155d29493854e57b8daf1867e6fc250.r2.dev/h1.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://pub-6fbff04eeb6c444fa79c22c8c01d96e2.r2.dev/loginonlinemicrosoffice.html	Get hash	malicious	Unknown	Browse	152.199.2.76
	http://gi.13-53-95-105.cprapid.com/	Get hash	malicious	Unknown	Browse	192.229.210.155
	https://pub-0b366962715b4b8ca9b67a32dc218dbf.r2.dev/bendel.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://pub-65810deb44054180bb55f4f4d29d5339.r2.dev/pot.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://cloudflare-geoipworker.resdiary.workers.dev	Get hash	malicious	Unknown	Browse	152.199.2.76
	e-EFT027_e-Wire#.PDF.htm	Get hash	malicious	Unknown	Browse	152.199.4.44
	https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://calm-snowflake-5721.on.fleek.co/#lauren.walsh@ifcfilms.com%20https://app.donorview.com/Communication/Click?prm=uEvQjbLyROfQy1XICroxZgnn6zkK-jxszv3c-V7QVTzbyWCRnwEo72rfjdFLOn6LD-AbzGoObSWvJEDMZH3l_sAl_z1NUhFuXl1zt3juOmIcN_J3w3rrSbzKkTErDNu48wmAjuOwMWYFji5HSlNfrNvlQzfcdYndFW3XpMVPR1ahJlmQEYNAysRt4-YWnhMQPXKbA4Diq5MECXxH0hT8_be4LADzMz-s1ZJP8a9qn301&target=https://calm-snowflake-5721.on.fleek.co/#lauren.walsh@ifcfilms.com	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://tmsnp.page.link/?link=https://akramrecruitment.com/youoh/timed/ththhtt/fnnfnf/kspmgp/cGF0cmljay5vY29ubmVsbEBhbWNuZXR3b3Jrcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	152.199.4.73
	https://r20.rs6.net/tn.jsp?f=001_WYI3T47uBiMxqAx_cuqnv9CjSwacGO-YLyNKHqyKTcZXrK0j90-UYW0CwXp0j5Ycewye-noNlU7sVY1oJUBN7Lf4HLk2X8upIb0-l9XNYmiI4Ra37IgaXk0gTcpluLVJ1RXUUDCKTKKBdQUH1tzmbBRBEANvrtd5mdoN0bzU0d7Ooz7B8qd4Q==&c=29mLu-_zya--lv5sulo6ab2FW8Uv_nurKInUhO6-UJIhdaiv_wuyMQ==&ch=KnuyiCVdrimyu2HLVoPolnX9BJHFW8Cc3cvnFdjTwn2FOU-s0ODPyQ==&__=?fN4Rk=a3dpZGVtYW5Aa29uaWFnLmNvbQ==	Get hash	malicious	Unknown	Browse	152.199.4.44
	http://malware.wicar.org/data/js_crypto_miner.html	Get hash	malicious	Coinhive	Browse	72.21.91.70
	https://pub-e155d29493854e57b8daf1867e6fc250.r2.dev/h1.html	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://recover-ry15622016488.start.page/	Get hash	malicious	Unknown	Browse	152.199.24.185
	!! ATTN Rapid Action Required- 10162023 703 AM.msg	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	http://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https%3A%2F%2Fwww.whitehallmontana.org/1mChE5QaB4ga0T9vKluB4glE5Ql4RsurE5Qa8D9vKoa8Dza	Get hash	malicious	HTMLPhisher	Browse	152.199.4.44
	https://www.canva.com/design/DAFxa6nP95M/30A4Czqu0-gIjdmONwpQ-Q/view?utm_content=DAFxa6nP95M&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	152.199.2.76

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7155
Entropy (8bit):	5.755103528710008
Encrypted:	false
SSDEEP:	192:akdVHUteiRUPhB6qRAq1k8SPxVLZ7VTiq:akdxUdCB6q3QxVNZTiq
MD5:	6BF1C3E38D8A4F43F5D74C56525381A2
SHA1:	B5E62D3C2AD6D50BCF864274265FBCA4C28EBDC2
SHA-256:	EFA5B30CBFC5D42F01F48809D7B9D9DA5792ABAAF9BB8B743A0B41084D314EDE
SHA-512:	65B00861B5789D94AC323BD08B163D839E83C65F23EFE95EC4878252F436569421C56055009617A3422B4ACCB039C01CD33196E8B1F438C38D02EF7A7AC58A02
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"new_device_experimentation":{"disable_popups_feature_checked":3,"disable_popups_treatment_applied":false,"google_sbs_feature_checked":3,"google_sbs_treatment_applied":false,"reduced_ads_feature_checked":3,"reduced_ntp_ads_fe

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17524
Entropy (8bit):	4.340063035506032
Encrypted:	false
SSDEEP:	192:wiuFhk5un5EpDdblzKaz+OJGbiIBJofNbr5/dn82/jqmo3qAi:rq25unWZd9dvJGiIBJoh387oAi
MD5:	03710426AB25AD1280E197F61249F9DE
SHA1:	F5E7A6FD42503AE4758BC36C8DD78D98EFB35047
SHA-256:	21E63F7C77896ED2B5F115957F2448E0A9E2DD738D7D487E471217421F6A93E1
SHA-512:	213CB55B8573335D1384AE704FF4267F224376056F71548660F9B2FDAA1203D8ABDDB787900AAF5D1E0AC6E5BE261F713BDBEFB67643D08E8D3672512A1AF588
Malicious:	false
Preview:	(function()..{.. var XHTML = "http://www.w3.org/1999/xhtml";.. .. // Time slicing constants.. var LIMIT = 10; // Maximum number of nodes to process before checking time.. var DURATION = 200; // Maximum amount of time (ms) to process before unblocking UI.. var DELAY = 15; // Amount of time (ms) to unblock UI.... // Tree building state.. var iterator;.. var nextNode;.. var root;.. var rootFirstChild;.. var time;.. .. // Template References.. var attrTemplate, attrName, attrValue;.. var elmStartTemplate, elmStartName;.. var elmEndTemplate, elmEndName;.. var cdataTemplate, cdataValue;.. var commentTemplate, commentValue;.. var style; .. .. // Only invoke this script if it was injected by our parser. Test for a condition that is.. // impossible for a markup to create - two direct children of the document... var secondRootElement = document.documentElement.nextElementSibling;.. if (secondRootElement == null

File type:	XML 1.0 document, ASCII text, with very long lines (18564), with no line terminators
Entropy (8bit):	6.012984201929854
TrID:	Generic XML (ASCII) (5005/1) 100.00%
File name:	signatures0.xml
File size:	18'564 bytes
MD5:	a4083556318e9b09f0f2788f6f5f8a03
SHA1:	b41d37adfd89abb634056e28ebe4dace74d247ed
SHA256:	4bb1653ebb174b389ce6d7c4bb63353d7559a8221a617cac8471ffc89059a5bd
SHA512:	32f1255c9873fa11a3549dcb0b96a70022e33c063e12935830c717ea2f3930b28aa753315c43f69559a41af58ec6aa682d9ace43010d543cb066b35d7c03f935
SSDEEP:	384:49fNqOpfcUnsUNMJ6Rn8J7wGxIjZg+P99Laz7OTPdh4MBKZs/QQzLbaNast9MBdL:4qOptNMJ6RnSEGxIj3aOTeyYk/aQstSL
TLSH:	1F826D2F8E8438363207E978CDAF304C4C4972779EF5A4B85C95390D8146FB978AD69E
File Content Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?><asic:XAdESSignatures xmlns:asic="http://uri.etsi.org/02918/v1.2.1#"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="id-2a06b2bf5e734cf8fca1d7485c2b1669"><ds:SignedInfo><ds:Canonicaliza

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report signatures0.xml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b119b08-9efa-4b65-ade8-59e1ba3edb16.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2177823b-f2ca-47ab-beac-50259bf409ab.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\37511e29-bc7c-448b-8bb4-42999ddde89c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b2172a7-4b21-449c-87dd-f0c5a5cc5016.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\595e5e85-0ccc-40c8-a985-70e5be95ca93.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f85fbe3-f0cc-4928-88b6-c661cab384ee.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7193b609-bf18-45bf-a0fd-a2ed2610c2cb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7bf4b374-3639-49d9-90cf-987d1844da2e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\40d81f6b-05ad-4d24-8fb8-98377ee4fa26.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-652FB097-1C38.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-652FB098-1D10.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-652FB0A8-2060.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-652FB0B1-2304.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d4d73fe-106f-4c00-9028-044e888cfe8b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3ab639a9-9e95-4d4d-8beb-2e36aa659c75.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4ca58a37-4d9a-4c8a-9649-9d24845d8748.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ec18b84-3cbf-4b1a-82dc-ade30d4f1a97.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9e74f929-1120-40f8-84cb-7f2bfa93abc9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Windows Analysis Report
signatures0.xml

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2023 12:16:59.423367977 CEST	64079	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:16:59.423775911 CEST	53153	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:16:59.576627970 CEST	53	64079	1.1.1.1	192.168.2.4
Oct 18, 2023 12:16:59.577095985 CEST	53	53153	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:00.408384085 CEST	63007	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:00.408498049 CEST	57416	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:00.562520027 CEST	53	63007	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:00.562545061 CEST	53	57416	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.035577059 CEST	54436	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.035849094 CEST	49300	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.037853956 CEST	51080	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.038093090 CEST	61233	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.059468985 CEST	53	56508	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.127717018 CEST	62492	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.127929926 CEST	50653	53	192.168.2.4	1.1.1.1
Oct 18, 2023 12:17:04.189589024 CEST	53	49300	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.189645052 CEST	53	54436	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.191015959 CEST	53	51080	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.191477060 CEST	53	61233	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.281306028 CEST	53	62492	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:04.281424999 CEST	53	50653	1.1.1.1	192.168.2.4
Oct 18, 2023 12:17:18.915034056 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.070379972 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.071820021 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.071837902 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.072170973 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.073525906 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.073998928 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.074198008 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.074676991 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.074779987 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.227195024 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.227220058 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.227236032 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.227245092 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.227252960 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.227797985 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.227891922 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.228261948 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.229585886 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.229703903 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.229935884 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:19.381069899 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:19.450468063 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.296757936 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.297255993 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.298294067 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.450871944 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.451014042 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.451147079 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.451191902 CEST	443	64866	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.452532053 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.452644110 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.452812910 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.458163977 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.458614111 CEST	64866	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.459374905 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.459614038 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.460501909 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.460609913 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.612736940 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.612786055 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.612822056 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.612905979 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.613270998 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.613270998 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.614492893 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.615329981 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.615461111 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.615796089 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:17:20.766586065 CEST	443	55055	162.159.61.3	192.168.2.4
Oct 18, 2023 12:17:20.803523064 CEST	55055	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:47.911919117 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:47.912193060 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:47.912542105 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:47.912710905 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.066297054 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.066859007 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.066900969 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.066915035 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.067078114 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.067090988 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.067231894 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.067231894 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.067276001 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.067775011 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.067987919 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.068475962 CEST	53231	443	192.168.2.4	162.159.61.3
Oct 18, 2023 12:18:48.220130920 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.220190048 CEST	443	53231	162.159.61.3	192.168.2.4
Oct 18, 2023 12:18:48.220475912 CEST	53231	443	192.168.2.4	162.159.61.3

Timestamp	kBytes transferred	Direction	Data
2023-10-18 10:16:59 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=117.0.2045.47&lang=en-GB&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: ghbmnnjooekpmoecnnnilnnbdlolhkhi X-Goog-Update-Updater: chromiumcrx-117.0.2045.47 MS-CV: QrggOLjC9IOVJqFqwQLJvF Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2023-10-18 10:17:00 UTC	0	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-sG2r4gwCwVY9y5lgl0DMSA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 18 Oct 2023 10:17:00 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6134 X-Daystart: 11820 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-18 10:17:00 UTC	1	IN	Data Raw: 33 30 61 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 33 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 31 31 38 32 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 30a<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6134" elapsed_seconds="11820"/><app appid="ghbmnnjooekpmoecnnnilnnbdlolhkhi" cohort="1::" cohortname=""
2023-10-18 10:17:00 UTC	1	IN	Data Raw: 4f 45 4b 50 4d 4f 45 43 4e 4e 4e 49 4c 4e 4e 42 44 4c 4f 4c 48 4b 48 49 5f 31 5f 36 39 5f 30 5f 30 2e 63 72 78 22 20 66 70 3d 22 31 2e 62 35 62 62 38 64 38 64 61 39 39 38 64 31 34 39 36 62 62 34 36 63 31 32 38 61 31 35 32 65 39 30 37 65 35 31 62 66 66 63 33 64 39 63 63 37 64 34 34 37 36 35 65 32 32 36 30 39 38 34 63 64 63 63 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 62 35 62 62 38 64 38 64 61 39 39 38 64 31 34 39 36 62 62 34 36 63 31 32 38 61 31 35 32 65 39 30 37 65 35 31 62 66 66 63 33 64 39 63 63 37 64 34 34 37 36 35 65 32 32 36 30 39 38 34 63 64 63 63 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 39 31 34 35 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 36 39 2e 30 22 2f 3e 3c 2f 61 70 70 3e 3c 2f Data Ascii: OEKPMOECNNNILNNBDLOLHKHI_1_69_0_0.crx" fp="1.b5bb8d8da998d1496bb46c128a152e907e51bffc3d9cc7d44765e2260984cdcc" hash_sha256="b5bb8d8da998d1496bb46c128a152e907e51bffc3d9cc7d44765e2260984cdcc" protected="0" size="91450" status="ok" version="1.69.0"/></app></
2023-10-18 10:17:00 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-10-18 10:17:03 UTC	92	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2023-10-18 10:17:04 UTC	93	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=604800 Content-Length: 11749 Content-Type: application/octet-stream Content-MD5: VZRmiqY3s2MwCXVaRioejA== Last-Modified: Mon, 02 Oct 2023 20:28:07 GMT Accept-Ranges: bytes ETag: "0x8DBC38616C48D88" X-Cache: TCP_REMOTE_HIT x-ms-request-id: 0d707b18-f01e-0050-6c49-01770f000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true X-Azure-Ref-OriginShield: 0oLAvZQAAAABdxo6+rE3nTYmxlKGP+oC0U0pDMjExMDUxMjA4MDI1ADgwNDE1ZGY3LThiZTMtNGUwZS1hYzEwLTI0NjU1NGE4NGUxNw== X-Azure-Ref: 0n7AvZQAAAACDb59G1v0yS5i19rf3ZHXcTEFYRURHRTIxMTgAODA0MTVkZjctOGJlMy00ZTBlLWFjMTAtMjQ2NTU0YTg0ZTE3 Date: Wed, 18 Oct 2023 10:17:03 GMT Connection: close
2023-10-18 10:17:04 UTC	94	IN	Data Raw: 7b 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 53 22 2c 0a 20 20 20 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATES",

Timestamp	kBytes transferred	Direction	Data
2023-10-18 10:17:04 UTC	105	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2023-10-18 10:17:04 UTC	105	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2023-10-18 10:17:04 UTC	106	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 18 Oct 2023 10:17:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8180078ccf320ad3-LAS alt-svc: h3=":443"; ma=86400
2023-10-18 10:17:04 UTC	106	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 02 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#^)

Timestamp	kBytes transferred	Direction	Data
2023-10-18 10:17:05 UTC	108	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2023-10-18 10:17:05 UTC	108	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2023-10-18 10:17:05 UTC	109	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 18 Oct 2023 10:17:05 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 81800790ebe00ad7-LAS alt-svc: h3=":443"; ma=86400
2023-10-18 10:17:05 UTC	109	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 4a 7d 89 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,J}^)

Timestamp	kBytes transferred	Direction	Data
2023-10-18 10:17:19 UTC	110	OUT	GET /filestreamingservice/files/008b3ca9-659d-4158-b079-5522d9c1cce3?P1=1698229021&P2=404&P3=2&P4=aIH%2fa%2f%2f7gYGJMKlj4%2f4UGpwNK5e6Rk6%2bRmPewh%2bKvqeMiUI%2fe%2bGYJ4Og0HCgzisGwwGdd3miyKf3Dp1onfn%2bJQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: ASH6akghPnLAXV9PRZ9Hm6 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2023-10-18 10:17:20 UTC	111	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3014198 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 18 Oct 2023 10:17:19 GMT Etag: "C1cbE/KK/NlpFRCAQr6xOmI6PNo=" Last-Modified: Wed, 13 Sep 2023 12:59:46 GMT MS-CorrelationId: 271d11fb-cd7e-4fb0-ac86-1ef8f6931a5d MS-CV: aNM2C8VwkOM2R+0j7L4jdY.0 MS-RequestId: 92ef2b2d-8015-44b3-be0f-499e3f4ee2eb Server: ECAcc (lac/55AC) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.2 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 10987 Connection: close
2023-10-18 10:17:20 UTC	112	IN	Data Raw: 43 72 32 34 03 00 00 00 1c 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Target ID:	0
Start time:	12:16:53
Start date:	18/10/2023
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\user\Desktop\signatures0.xml
Imagebase:	0x8e0000
File size:	225'176 bytes
MD5 hash:	A2E6E2A1C125973A4967540FD08C9AF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:16:54
Start date:	18/10/2023
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\user\Desktop\signatures0.xml
Imagebase:	0x7ff60cc80000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	12:16:55
Start date:	18/10/2023
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0xda0000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	12:16:56
Start date:	18/10/2023
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2012,i,13041603363956546002,27680066801817868,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false