24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T420,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 7a45a529b275… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a45a529b275…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5"],"about":{"@type":"SoftwareApplication","name":"bounty-65031670637844130","applicationCategory":["html"],"identifier":"7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T693,"dbghelp.dll" (Indicator: "dbghelp.dll") in Source: 00000000-00006360-00000C1D-53797019 "\Device\HarddiskVolume2\Windows\System32\dbghelp.dll" (Indicator: "dbghelp.dll") in Source: 00000000-00006360.00000000.76603.00268000.00000004.mdmp 00000000-00006360.00000001.78520.00268000.00000004.mdmp 00000000-00006360.00000002.80443.00268000.00000004.mdmp ":\WINDOWS\SYSTEM32\dbghelp.dll" (Indicator: "dbghelp.dll") in Source: 00000000-00006360.00000000.76603.0DAD0000.00000004.mdmp 00000000-00006360.00000001.78520.0DAD0000.00000004.mdmp 00000000-00006360.00000002.80443.0DAD0000.00000004.mdmp "Authentication finished.Microsoft Edge is trying to fill passwords. Type your Windows password to allow this.Before you update your autofill settings, please enter your device password for verification.Edge Process MonitorQR code to install Microsoft EdgeScan this QR code with your mobile device to install Microsoft EdgeTo send web pages between your devices, install and sign into Microsoft Edge on your mobile device.Got ItMicrosoft privacy policy{num_people, plural, offset:1" (Indicator: "process monitor") in Source: 00000000-00006360.00000000.76603.0DD60000.00000002.mdmp 00000000-00006360.00000001.78520.0DD60000.00000002.mdmp 00000000-00006360.00000002.80443.0DD60000.00000002.mdmp "dbghelp.dll" (Indicator: "dbghelp.dll") in Source: 00000000-00006360.00000000.76603.130AD000.00000002.mdmp 00000000-00006360.00000000.76603.40C76000.00000002.mdmp 00000000-00006360.00000001.78520.130AD000.00000002.mdmp 00000000-00006360.00000001.78520.40C76000.00000002.mdmp 00000000-00006360.00000002.80443.130AD000.00000002.mdmp 00000000-00006360.00000002.80443.40C76000.00000002.mdmp26:T4a3,"YouTube-Restrict" (Indicator: "youtube") "facebook.com" (Indicator: "facebook.com") "netflix.com" (Indicator: "netflix.com") "youtube.com" (Indicator: "youtube") "twitter.com" (Indicator: "twitter") "www.netflix.com" (Indicator: "netflix.com") "www.facebook.com" (Indicator: "facebook.com") "You can add Flipgrid and YouTube videos to PDFs as comments.We would love to hear any enhancements you would like to see in this feature. Please use the send feedback option or tweet with #EdgeEdu #EdgeCamera)PresentComment SavedComment DeletedThis file is password protected. Please enter a password to open the file.Enter a passwordCheck your passwordWe can't open this fileSign in to open this fileThis is a protected file. Sign in with your work or school account to open it.Need permissionsContact the owner of the file to give you permissions.Switch to a work or school accountThis file is protected. To open it, go to Settings and more" (Indicator: "youtube") "px.ads.linkedin.com" (Indicator: "linkedin.com") "ds.linkedin.com" (Indicator: "linkedin.com") "https://px.ads.linkedin.com:443,*" (Indicator: "linkedin.com") "settings.force_youtube_restrict" (Indicator: "youtube")27:Tbea,"000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00006360] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\0.0.0.10\manifest.fingerprint]- [targetUID: 00000000-00006360] "b8abc90a-ef48-4063-b75e-122655924395.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b8abc90a-ef48-4063-b75e-122655924395.tmp]- [targetUID: 00000000-00006360] "LICENSE" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23\Sigma\LICENSE]- [targetUID: 00000000-00006360] "DashTrackerDatabase" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DashTrackerDatabase]- [targetUID: 00000000-00006360] "product_page.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6360_934385778\product_page.js]- [targetUID: 00000000-00006360] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00006360] "manifest.json" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\0.0.0.10\manifest.json]- [targetUID: 00000000-00006360] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00006360] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00006360] "typosquatting_list.pb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\SafetyTips\2935\typosquatting_list.pb]- [targetUID: 00000000-00006360] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001]- [targetUID: 00000000-00006360] "b25c4b8b-ec59-4f04-b8f1-2e4f65d637fc.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\b25c4b8b-ec59-4f04-b8f1-2e4f65d637fc.tmp]- [targetUID: 00000000-00005852] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00006360] "d8ae42e9-4586-461d-8fe7-7d7130ab52ee.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\d8ae42e9-4586-461d-8fe7-7d7130ab52ee.tmp]- [targetUID: 00000000-00006360] "Variations" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00006360] "manifest.json" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Kids Mode\0.0.0.10\manifest.json]- [targetUID: 00000000-00006360]28:T5d0,"product_page.js" has type "UTF-8 Unicode text with very long lines with CRLF line terminators"- Location: [%TEMP%\6360_934385778\product_page.js]- [targetUID: 00000000-00006360] "auto_open_controller.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\auto_open_controller.js]- [targetUID: 00000000-00006360] "shoppingfre.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\shoppingfre.js]- [targetUID: 00000000-00006360] "edge_checkout_page_validator.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\edge_checkout_page_validator.js]- [targetUID: 00000000-00006360] "edge_tracking_page_validator.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\edge_tracking_page_validator.js]- [targetUID: 00000000-00006360] "shopping_iframe_driver.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\shopping_iframe_driver.js]- [targetUID: 00000000-00006360] "edge_driver.js" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\2.0.4516.0\edge_driver.js]- [targetUID: 00000000-00006360] "edge_confirmation_page_validator.js" has type "Unknown"- Location: [%TEMP%\6360_934385778\edge_confirmation_page_validator.js]- [targetUID: 00000000-00006360] "shopping.js" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Edge Shopping\2.0.4516.0\shopping.js]- [targetUID: 00000000-00006360] "adblock_snippet.js" has type "Unknown"- Location: [%TEMP%\6360_1215131385\adblock_snippet.js]- [targetUID: 00000000-00006360]29:T41f,Potential IP "10.34.0.45" found in string "%LOCALAPPDATA%\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\35\10.34.0.45" "0.0.0.0" "10.34.0.24" "1.3.157.61" "3.0.0.0" "0.0.0.10" "1.0.0.8" "1.15.0.1" "1.0.0.23" "1.1.0.0" "3.0.0.3" "0.0.1.4" "1.0.0.2" "192.168.243.157" Potential IP "1.0.0.0" found in string "UIAutomationCore,type="win32",version="1.0.0.0"C:\Windows\System32\UIAutomationCore.DLL" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32,processorArchitecture="*",type="win32",version="5.1.0.0"C:\WINDOWS\WindowsShell.Manifest" Potential IP "0.0.0.0" found in string "0.0.0.0-devel" Potential IP "1.0.0.8" found in string "ent\1.0.0.8" Potential IP "1.15.0.1" found in string "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1" Potential IP "1.0.0.23" found in string "C:\Users\HAPUBWS\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.23" Potential IP "239.255.255.250" found in string "HOST: 239.255.255.250:1900" "1.0.0.0" "1.0.0.1"2a:Tceb6,Pattern match: "https://easylist.to/" Pattern match: "https://github.com/easylist" Pattern match: "https://creativecommons.org/" Pattern match: "https://creativecommons.org/compatiblelicenses" Pattern match: "http://zetaros.000webhostapp.com/search?fz=ZjRHZHFkbFA0UExjdTlGWDNZNENqWW5ZTUxURTR0Y0JGVmRtNkl4S0VDZz0%3D" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wtc3?ver=79e5,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqHh?ver=0f07,copyright:Yuanping" Pattern match: "www.playstation.com},{applied_policy:block,domain:bing.com},{applied_policy:block,domain:browserbench.org},{applied_policy:block,domain:www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applie" Pattern match: "https://idsync.rlcdn.com,supports_spdy:true},{isolation:[],server:https://pippio.com,supports_spdy:true},{isolation:[],server:https://assets.msn.com,supports_spdy:true},{isolation:[],server:https://ntp.msn.com,supports_spdy:true}" Pattern match: "www.bing.com" Heuristic match: "edgeservices.bing.com" Heuristic match: "ntp.msn.cn" Heuristic match: "windows.msn.cn" Heuristic match: "network_primary_browser.network_usage.ie" Heuristic match: "sling.com" Heuristic match: "tou.tv" Heuristic match: "maxdome.de" Heuristic match: "abc.com" Heuristic match: "tv.apple.com" Heuristic match: "la7.it" Heuristic match: "xfinity.com" Heuristic match: "watchtv.cox.com" Heuristic match: "ignitetv.rogers.com" Heuristic match: "bluecurvetv.shaw.ca" Heuristic match: "helix.videotron.com" Heuristic match: "criterionchannel.com" Heuristic match: "ntathome.com" Heuristic match: "wowpresentsplus.com" Heuristic match: "vhx.tv" Heuristic match: "hulu.com" Heuristic match: "app.quickhelp.com" Heuristic match: "DishAnywhere.com" Heuristic match: "nintendo.com" Heuristic match: "hangouts.google.com" Heuristic match: "chat.google.com" Heuristic match: "slack.com" Heuristic match: "facebook.com" Heuristic match: "wechat.com" Heuristic match: "weixin.com" Heuristic match: "qq.com" Heuristic match: "webex.com" Heuristic match: "wordpress.com" Heuristic match: "browserbench.org" Heuristic match: "rbench.org" Heuristic match: "web.basemark.com" Heuristic match: "semark.com" Heuristic match: "mozilla.github.io" Heuristic match: "a.github.io" Heuristic match: "html5test.com" Heuristic match: "est.com" Heuristic match: "necromanthus.com" Heuristic match: "anthus.com" Pattern match: "www.wirple.com" Heuristic match: "rple.com" Heuristic match: "chromium.github.io" Heuristic match: "octane.webmarks.info" Heuristic match: ".webmarks.info" Heuristic match: "css3test.com" Heuristic match: "ks.info" Heuristic match: "st.com" Heuristic match: "files.unity3d.com" Heuristic match: "unity3d.com" Heuristic match: "ity3d.com" Heuristic match: "3d.com" Heuristic match: "msn.com" Heuristic match: "netflix.com" Heuristic match: "music.amazon.co.jp" Heuristic match: "music.amazon.co.uk" Heuristic match: "music.amazon.com" Heuristic match: "music.amazon.de" Heuristic match: "music.amazon.es" Heuristic match: "music.amazon.fr" Heuristic match: "music.amazon.in" Heuristic match: "music.amazon.it" Heuristic match: "music.amazon.ca" Heuristic match: "music.amazon.com.br" Heuristic match: "openidconnectweb.azurewebsites.net" Heuristic match: "youtube.com" Heuristic match: "e.com" Heuristic match: "2mdn.net" Heuristic match: "azurewebsites.net" Heuristic match: "bsites.net" Heuristic match: "es.net" Heuristic match: "bing.com" Pattern match: "www.caisse-epargne.fr" Heuristic match: "sse-epargne.fr" Heuristic match: "codepen.io" Heuristic match: "epargne.fr" Heuristic match: "defenderrazor.com" Heuristic match: "rrazor.com" Heuristic match: "pexels.com" Heuristic match: "or.com" Heuristic match: "duckduckgo.com" Heuristic match: "kgo.com" Heuristic match: "k.com" Heuristic match: "googlesyndication.com" Heuristic match: "yndication.com" Heuristic match: "instagram.com" Heuristic match: "ion.com" Heuristic match: "am.com" Heuristic match: "live.com" Heuristic match: "office.com" Heuristic match: "officeapps.live.com" Heuristic match: "pps.live.com" Heuristic match: "openrailwaymap.org" Heuristic match: "lwaymap.org" Heuristic match: "outbrainimg.com" Heuristic match: "nimg.com" Heuristic match: "search.naver.com" Heuristic match: "naver.com" Heuristic match: "search.yahoo.com" Heuristic match: "yahoo.com" Heuristic match: "sharepoint.com" Heuristic match: "int.com" Heuristic match: "storage.live.com" Heuristic match: ".live.com" Heuristic match: "svc.ms" Heuristic match: "tiktok.com" Heuristic match: "twitter.com" Heuristic match: "web.whatsapp.com" Heuristic match: "tsapp.com" Heuristic match: "yammer.com" Heuristic match: "p.com" Heuristic match: "eip.ccfsm.or.kr" Heuristic match: "or.kr" Heuristic match: "hbonow.com" Heuristic match: "hboportugal.com" Heuristic match: "l.com" Heuristic match: "hbogo.com" Heuristic match: "hbogo.bg" Heuristic match: "hbogo.ro" Heuristic match: "hbogo.cz" Heuristic match: "wrc.t-mobile.com" Heuristic match: "ile.com" Heuristic match: "meituan.com" Heuristic match: "go.canaldigital.fi" Heuristic match: "ldigital.fi" Heuristic match: "go.canaldigital.no" Heuristic match: "ldigital.no" Heuristic match: "go.canaldigital.se" Heuristic match: "ldigital.se" Heuristic match: "canaldigital.dk" Heuristic match: "tal.dk" Heuristic match: "ide.cs50.io" Heuristic match: "moneygram.com" Heuristic match: "blog.esuteru.com" Heuristic match: "eru.com" Heuristic match: "myslate.sixphrase.com" Heuristic match: "ixphrase.com" Heuristic match: "search.norton.com" Heuristic match: "rton.com" Heuristic match: "applychildcaresubsidy.alberta.ca" Heuristic match: "elearning.evn.com.vn" Heuristic match: ".evn.com.vn" Heuristic match: "authoring.amirsys.com" Heuristic match: ".amirsys.com" Heuristic match: "app.fields.corteva.com" Heuristic match: "s.corteva.com" Heuristic match: "gsq.minornet.com" Heuristic match: "a.com" Heuristic match: "net.com" Heuristic match: "shop.lic.co.nz" Heuristic match: "portal.centurylink.com" Heuristic match: "nturylink.com" Heuristic match: "visitnow.org" Heuristic match: "ylink.com" Pattern match: "www.hotstar.com" Heuristic match: "nk.com" Heuristic match: "ar.com" Heuristic match: "tryca.st" Heuristic match: "astrogo.astro.com.my" Heuristic match: "stro.com.my" Heuristic match: "airbornemedia.inflightinternet.com" Heuristic match: "app.classkick.com" Heuristic match: "kick.com" Heuristic match: "bm.gzekao.cn" Heuristic match: "salud.go.cr" Heuristic match: "learning.chungdahm.com" Heuristic match: "chungdahm.com" Heuristic match: "gooroomee.com" Heuristic match: "dahm.com" Heuristic match: "tenantev.com" Heuristic match: "printful.com" Heuristic match: "fansnet.jp" Heuristic match: "app.houseparty.com" Heuristic match: "party.com" Heuristic match: "hanafloralpos2.com" Heuristic match: "lpos2.com" Heuristic match: "moji365.com" Heuristic match: "elroyalecasino.com" Heuristic match: "asino.com" Heuristic match: "portal.greenxtrade.com" Heuristic match: "eenxtrade.com" Heuristic match: "aussieplaybonuses.com" Heuristic match: "ybonuses.com" Heuristic match: "front.viewinter.ai" Heuristic match: "winter.ai" Heuristic match: "app.evisit.com" Heuristic match: "t.com" Heuristic match: "richpalms.com" Heuristic match: "lilyclass.com" Heuristic match: "hiflow.com" Heuristic match: "my.a-bly.com" Heuristic match: "login.hourpowerpro.com" Heuristic match: "rpowerpro.com" Heuristic match: "crayondatabase.com" Heuristic match: "abase.com" Heuristic match: "elroyalecasinomail.com" Heuristic match: "asinomail.com" Heuristic match: "aussieplaypromos.com" Heuristic match: "ypromos.com" Heuristic match: "eu.smilemate.com" Heuristic match: "ate.com" Heuristic match: "live.remo.co" Heuristic match: "orders.cutcoapps.com" Heuristic match: "tcoapps.com" Heuristic match: "app.pharmulary.com" Heuristic match: "ulary.com" Heuristic match: "learn.maplesoft.com" Heuristic match: "lesoft.com" Heuristic match: "tv.partner.co.il" Heuristic match: "r.co.il" Heuristic match: "ykc.hanwangjiaoyu.com" Heuristic match: "ngjiaoyu.com" Heuristic match: "icingimages.com" Heuristic match: "es.com" Heuristic match: "duolingo.com" Heuristic match: "geforcenow.com" Heuristic match: "w.com" Heuristic match: "capitaloneoffers.com" Heuristic match: "eoffers.com" Heuristic match: "yorbit.mindtree.com" Heuristic match: "ndtree.com" Heuristic match: "prepmod.doh.wa.gov" Heuristic match: "oh.wa.gov" Heuristic match: "ome.tv" Heuristic match: "wowow.co.jp" Heuristic match: "wa.gov" Heuristic match: "sankuai.com" Heuristic match: "prezi.com" Heuristic match: "algoritmika.az" Heuristic match: "ka.az" Heuristic match: "whitehatjr.com" Heuristic match: "r.com" Pattern match: "www.skyroom.online" Heuristic match: "videochatru.com" Heuristic match: "ru.com" Pattern match: "www.yuque.com" Heuristic match: "hllqp.com" Heuristic match: "unacademy.com" Heuristic match: "mazonecec.com" Heuristic match: "cs.zaq.ne.jp" Heuristic match: "chat-pt.com" Heuristic match: "nativecamp.net" Heuristic match: "p.net" Heuristic match: "newrow.com" Pattern match: "www.chess.com" Heuristic match: "pixton.com" Heuristic match: "bank.dream-1.co.kr" Heuristic match: "m-1.co.kr" Heuristic match: "siga.aduanas.gob.do" Heuristic match: "nas.gob.do" Heuristic match: "mettl.com" Heuristic match: "granbluefantasy.jp" Heuristic match: "antasy.jp" Heuristic match: "xiaomawang.com" Heuristic match: "g.com" Heuristic match: "talview.com" Heuristic match: "vpn.zmaxis.com" Heuristic match: "s.com" Pattern match: "www.quebon.tv" Pattern match: "www.flexclip.com" Heuristic match: "lip.com" Heuristic match: "minedia.com" Pattern match: "www.filemaru.com" Heuristic match: "aru.com" Heuristic match: "hirepro.in" Heuristic match: "u.com" Heuristic match: "lwss.cdgdc.edu.cn" Heuristic match: "c.edu.cn" Heuristic match: "keckmedicine.org" Heuristic match: "ine.org" Heuristic match: "kaipoke.biz" Heuristic match: "app.bookcreator.com" Heuristic match: "player.pl" Heuristic match: "live.twebcast.com" Heuristic match: "cast.com" Heuristic match: "web.openrainbow.com" Heuristic match: "ainbow.com" Pattern match: "www.storyboardthat.com" Heuristic match: "boardthat.com" Pattern match: "www.techfluency.org" Heuristic match: "luency.org" Pattern match: "www.amway.co.kr" Heuristic match: ".co.kr" Heuristic match: "smartschool.be" Heuristic match: "ol.be" Heuristic match: "bm.chsi.com.cn" Heuristic match: "om.cn" Pattern match: "www.n-gaku.ed.jp" Heuristic match: "u.ed.jp" Heuristic match: "start.ipc.qld.edu.au" Heuristic match: ".qld.edu.au" Heuristic match: "global.talk-cloud.net" Heuristic match: "lk-cloud.net" Pattern match: "www.protrainings.com" Heuristic match: "ainings.com" Pattern match: "www.rarejob.com" Heuristic match: "ob.com" Heuristic match: "chatalternative.com" Pattern match: "https://permanently-removed.invalid/embedded/setup/chrome/usermenu" Pattern match: "https://permanently-removed.invalid/ListAccounts?json=standard" Pattern match: "https://permanently-removed.invalid/encryption/unlock/desktop" Pattern match: "https://permanently-removed.invalid/signin/chrome/sync?ssp=1" Pattern match: "https://permanently-removed.invalid/embedded/reauth/chromeos" Pattern match: "https://permanently-removed.invalid/embedded/setup/windows" Pattern match: "https://permanently-removed.invalid/embedded/setup/kidsignin/chromeos" Pattern match: "https://permanently-removed.invalid/embedded/setup/kidsignup/chromeos" Pattern match: "https://permanently-removed.invalid/embedded/setup/v2/chromeos" Pattern match: "https://wus2-000.designerapp.officeapps.live-int.com/designerapp/static" Pattern match: "http://permanently-removed.invalid/v1/accountcapabilities:batchGet" Pattern match: "https://permanently-removed.invalid/o/oauth/GetOAuthToken/" Pattern match: "https://permanently-removed.invalid/GetCheckConnectionInfo" Pattern match: "https://permanently-removed.invalid/embedded/xreauth/chrome" Pattern match: "https://permanently-removed.invalid/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB" Heuristic match: "soft.As" Pattern match: "www.principledtechnologies.com" Heuristic match: "octanetestapp.herokuapp.com" Heuristic match: "img-s-msn-com.akamaized.net" Heuristic match: "free-freecell-solitaire.com" Heuristic match: "smallbusiness.yahoo.com" Heuristic match: "virtualvisitlogin.partners.org" Heuristic match: "carelogin.bryantelemedicine.com" Heuristic match: "providerstc.hs.utah.gov" Heuristic match: "elearning.seabank.com.vn" Heuristic match: "telehealthportal.uofuhealth.org" Heuristic match: "airbornemedia.gogoinflight.com" Heuristic match: "exchangeservicecenter.com" Heuristic match: "bancodeoccidente.com.co" Heuristic match: "scheduling.care.psjhealth.org" Heuristic match: "elroyalecasinobonuses.com" Heuristic match: "newstudentregistration.nmsu.edu" Heuristic match: "app.mytaxprepoffice.com" Heuristic match: "suppliersmx.smp-automotive.com" Heuristic match: "lacite.essentialskillsgroup.com" Heuristic match: "my.globaluniversity.edu" Heuristic match: "totale.rosettastone.com" Heuristic match: "prepmod.health.state.mn.us" Heuristic match: "secure.priviahealth.com" Heuristic match: "vroom.truevirtualworld.com" Heuristic match: "app.jigsawinteractive.com" Heuristic match: "app.smarterproctoring.com" Heuristic match: "sigaexplorer.aduanas.gob.do" Heuristic match: "login.smasheducation.com" Heuristic match: "onlyonefoodnet.ifresh.co.kr" Heuristic match: "coronavirus.maryland.gov" Pattern match: "www.niubizenlinea.com.pe" Heuristic match: "online.aufratenzur.bawagpsk.com" Heuristic match: "bcpzonasegurabeta.viabcp.com" Heuristic match: "vaccinereg.health.nd.gov" Heuristic match: "syscheck.bridge.psiexams.com" Heuristic match: "learning.apaxleaders.edu.vn" Heuristic match: "sanayisicil.sanayi.gov.tr" Heuristic match: "pinfrafacturacion.com.mx" Heuristic match: "kealahou.cfht.hawaii.edu" Heuristic match: "microsoftnewsforkids.com" Heuristic match: "listeningparty.bts-butter.com" Heuristic match: "login.microsoftonline.com" Heuristic match: "login.microsoftonline.de" Heuristic match: "login.microsoftonline.us" Heuristic match: "login-us.microsoftonline.com" Heuristic match: "spp.tsm.ibmserviceengage.com" Heuristic match: "timesofindia.indiatimes.com" Pattern match: "https://azureedge.net/" Pattern match: "https://bing.com/" Pattern match: "https://google.com/" Pattern match: "https://live-int.com/" Pattern match: "https://live.com/" Pattern match: "https://microsoft.com/" Pattern match: "https://msn.cn/" Pattern match: "https://msn.com/" Heuristic match: "native.com" Heuristic match: "socialive.us" Heuristic match: "ve.com" Pattern match: "www.zhihu.com" Heuristic match: "mindbody.io" Heuristic match: "hubgame.cn" Heuristic match: "mega.nz" Heuristic match: "univer.kaznpu.kz" Heuristic match: "znpu.kz" Pattern match: "www.jkydata.com" Heuristic match: "ta.com" Heuristic match: "clipchamp.com" Heuristic match: "yz.cainiao.com" Heuristic match: "o.com" Heuristic match: "app.boardable.com" Heuristic match: "able.com" Heuristic match: "kakao.com" Heuristic match: "ble.com" Heuristic match: "blibee.com" Heuristic match: "le.com" Heuristic match: "woots.nl" Heuristic match: "webinar.anymeeting.com" Heuristic match: "nymeeting.com" Pattern match: "www.valr.com" Heuristic match: "eting.com" Heuristic match: "rwanda.edacy.com" Heuristic match: "acy.com" Heuristic match: "wing.coupang.com" Heuristic match: "ang.com" Heuristic match: "portal.greenxtrade.cn" Heuristic match: "eenxtrade.cn" Pattern match: "www.alarm.com" Heuristic match: "integra.co.in" Heuristic match: "1cs.jp" Heuristic match: "axisbank.com" Heuristic match: "customs.vans.com.cn" Heuristic match: "ans.com.cn" Heuristic match: "dsp.horse24.com" Heuristic match: "24.com" Heuristic match: "order.campion.com.au" Heuristic match: "pion.com.au" Pattern match: "www.xthk.cn" Heuristic match: "lemo.share-platform.de" Heuristic match: "e-platform.de" Heuristic match: "vc.dial070.co.kr" Heuristic match: "rm.de" Heuristic match: "0.co.kr" Pattern match: "www.gaosiedu.com" Heuristic match: "edu.com" Heuristic match: "all-dream.com" Pattern match: "www.typing.com" Pattern match: "www.bitpaper.io" Heuristic match: "per.io" Heuristic match: "tophat.com" Heuristic match: "home.ibotta.com" Pattern match: "www.comassvax.org" Heuristic match: "svax.org" Pattern match: "www.mtreadyclinic.org" Heuristic match: "dyclinic.org" Pattern match: "www.vaccinateri.org" Heuristic match: "nateri.org" Pattern match: "www.marylandvax.org" Heuristic match: "andvax.org" Heuristic match: "myhealth.alaska.gov" Heuristic match: "alaska.gov" Heuristic match: "fx.dmm.com" Heuristic match: "aska.gov" Heuristic match: "kyc.icicibank.com" Heuristic match: "bank.com" Heuristic match: "hd.kinopoisk.ru" Heuristic match: "isk.ru" Heuristic match: "aiosante.fr" Heuristic match: "mentora.co" Heuristic match: "maj.leboncoin.fr" Heuristic match: "coin.fr" Heuristic match: "new.faberlic.com" Heuristic match: "lic.com" Heuristic match: "support.proxyvote.com" Heuristic match: "roxyvote.com" Heuristic match: "logon.mykpa.com" Heuristic match: "pa.com" Heuristic match: "power2patient.net" Heuristic match: "ient.net" Heuristic match: "h5.hunbei.com" Heuristic match: "siharka.menpan.go.id" Heuristic match: "enpan.go.id" Heuristic match: "provider.teladoc.com" Heuristic match: "teladoc.com" Heuristic match: "codelion.net" Heuristic match: "doc.com" Heuristic match: "kaleoz.com" Heuristic match: "demos.cutcoapps.com" Heuristic match: "coapps.com" Heuristic match: "eps.jspl.com" Heuristic match: "ps.com" Heuristic match: "managing.h-navi.jp" Heuristic match: "h-navi.jp" Heuristic match: "app.showit.co" Heuristic match: "co-verify.com" Heuristic match: "app.axiumascend.com" Heuristic match: "ascend.com" Heuristic match: "cyedu.kead.or.kr" Heuristic match: "d.or.kr" Heuristic match: "service.medicheck.se" Heuristic match: "edicheck.se" Heuristic match: "sio.men.gov.pl" Heuristic match: "ck.se" Heuristic match: "ov.pl" Heuristic match: "i.cqu.edu.cn" Heuristic match: "conv.gryphondds.com" Heuristic match: "hondds.com" Heuristic match: "business.curated.com" Heuristic match: "curated.com" Heuristic match: "platinum-options.com" Heuristic match: "options.com" Heuristic match: "pjxt.lnen.cn" Heuristic match: "ons.com" Heuristic match: "docs.google.com" Heuristic match: "speechtexter.com" Heuristic match: "ter.com" Heuristic match: "admall.youpenglai.com" Heuristic match: "upenglai.com" Heuristic match: "buy.icicibank.com" Heuristic match: "oa.imuyuan.com" Heuristic match: "n.com" Heuristic match: "clube.dermaclub.com.br" Heuristic match: "b.com.br" Heuristic match: "msnvideo.com" Heuristic match: "msnkids.com" Heuristic match: "microsoftnews.cn" Heuristic match: "om.br" Heuristic match: "msn.cn" Heuristic match: "msnewskids.com" Heuristic match: "microsoftnewskids.com" Heuristic match: "ids.com" Heuristic match: "msn-amp.com" Heuristic match: "microsoftnews.com" Heuristic match: "msnewsmedia.com" Heuristic match: "abema.tv" Heuristic match: "acorn.tv" Heuristic match: "bilibili.com" Heuristic match: "chaines-tv.orange.fr" Heuristic match: "nge.fr" Heuristic match: "ctc.ru" Heuristic match: "dk.hbonordic.com" Heuristic match: "hbogo.pl" Heuristic match: "listen.tidal.com" Heuristic match: "mcg.decipherinc.com" Heuristic match: "c.com" Heuristic match: "music.apple.com" Heuristic match: "now.dstv.com" Heuristic match: "okko.tv" Heuristic match: "open.spotify.com" Heuristic match: "opto.sic.pt" Heuristic match: "orangetv.orange.es" Heuristic match: "play.hbomax.com" Heuristic match: "play.waipu.tv" Heuristic match: "stream.osn.com" Heuristic match: "tv.rakuten.co.jp" Heuristic match: "tv.yousee.dk" Heuristic match: "tvthek.orf.at" Heuristic match: "v.ouj.ac.jp" Heuristic match: "v.youku.com" Heuristic match: "ver.movistarplus.es" Heuristic match: "us.es" Heuristic match: "video.dmkt-sp.jp" Heuristic match: "video.unext.jp" Heuristic match: "videomarket.dmm.com" Heuristic match: "m.com" Heuristic match: "vod.canalplus.com" Heuristic match: "vod.tvp.pl" Heuristic match: "voyo.markiza.sk" Heuristic match: "voyo.nova.cz" Heuristic match: "vtm.be" Heuristic match: "watch.spectrum.net" Heuristic match: "watcha.com" Heuristic match: "wink.rt.ru" Pattern match: "www.6play.fr" Pattern match: "www.atresplayer.com" Pattern match: "www.audible.com" Pattern match: "www.canalplus.com" Pattern match: "www.channel4.com" Pattern match: "www.crunchyroll.com" Pattern match: "www.dazn.com" Pattern match: "www.directvgo.com" Pattern match: "www.filmin.es" Pattern match: "www.fubo.tv" Pattern match: "www.glaz.tv" Pattern match: "www.hoopladigital.com" Heuristic match: "tal.com" Pattern match: "www.horizon.tv" Heuristic match: "al.com" Pattern match: "www.hulu.com" Pattern match: "www.imdb.com" Pattern match: "www.itv.com" Pattern match: "www.ivi.ru" Pattern match: "www.my5.tv" Pattern match: "www.netflix.com" Pattern match: "www.npostart.nl" Pattern match: "www.paramountplus.com" Heuristic match: "lus.com" Pattern match: "www.peacocktv.com" Pattern match: "www.primevideo.com" Pattern match: "www.rts.ch" Pattern match: "www.salto.fr" Pattern match: "www.streamz.be" Pattern match: "www.telenettv.be" Pattern match: "www.tntdrama.com" Pattern match: "www.twitch.tv" Pattern match: "www.viki.com" Pattern match: "www.vudu.com" Pattern match: "www.weverse.io" Pattern match: "www.ziggogo.tv" Heuristic match: "yandex.ru" Heuristic match: "login.windows-ppe.net" Heuristic match: "login.microsoftonline.eaglex.ic.gov" Heuristic match: "ppe.net" Heuristic match: "login.partner.microsoftonline.cn" Heuristic match: "powerapps.com" Heuristic match: "office365.us" Heuristic match: "ohome.apps.mil" Heuristic match: "ohome.eaglex.ic.gov" Heuristic match: "c.gov" Heuristic match: "jinshuschool.cn" Heuristic match: "ool.cn" Heuristic match: "app.figure1.com" Heuristic match: "e1.com" Heuristic match: "bmo.com" Heuristic match: "immunizealberta.ca" Heuristic match: "ealberta.ca" Pattern match: "www.souz-mid.ru" Heuristic match: "z-mid.ru" Heuristic match: "auningkartpark.dk" Heuristic match: "artpark.dk" Pattern match: "www.my46.org" Heuristic match: "6.org" Pattern match: "www.rocdefrance.fr" Heuristic match: "portal.digitalbusiness.telstra.com" Heuristic match: "defrance.fr" Heuristic match: "espace-sante-international.humanis.com" Pattern match: "www2.gistda.or.th" Heuristic match: "stda.or.th" Heuristic match: "isro.gov.in" Heuristic match: "or.th" Heuristic match: "osunsa.ddns.net" Heuristic match: "ns.net" Heuristic match: "rev.com" Heuristic match: "app.initlive.com" Heuristic match: "ive.com" Heuristic match: "atitesting.com" Heuristic match: "mheducation.com" Heuristic match: "on.com" Heuristic match: "honorlock.com" Heuristic match: "ck.com" Pattern match: "www.reddit.com" Heuristic match: "egraphindia.com" Heuristic match: "dit.com" Pattern match: "www.telegraphindia.com" Heuristic match: "pushengage.com" Heuristic match: "age.com" Pattern match: "www.timesnownews.com" Heuristic match: "esnownews.com" Pattern match: "www.couponrani.com" Heuristic match: "ponrani.com" Pattern match: "www.wholesomeyum.com" Heuristic match: "lesomeyum.com" Pattern match: "www.asklaila.com" Heuristic match: "laila.com" Pattern match: "www.sammobile.com" Heuristic match: "mobile.com" Pattern match: "www.ecuavisa.com" Heuristic match: "avisa.com" Heuristic match: "uz.sputniknews.ru" Heuristic match: "niknews.ru" Pattern match: "www.ndtv.com" Heuristic match: "v.com" Pattern match: "www.elimparcial.com" Heuristic match: "mparcial.com" Pattern match: "www.povarenok.ru" Heuristic match: "arenok.ru" Pattern match: "www.estadao.com.br" Heuristic match: "adao.com.br" Heuristic match: "olxpakistan.os.tc" Heuristic match: "stan.os.tc" Heuristic match: "televisa.com" Heuristic match: "uol.com.br" Pattern match: "www.axisbank.com" Heuristic match: "mutualfund.adityabirlacapital.com" Heuristic match: "sbank.com" Pattern match: "www.facebook.com" Heuristic match: "ebook.com" Pattern match: "www.instagram.com" Heuristic match: "tagram.com" Pattern match: "www.messenger.com" Heuristic match: "senger.com" Heuristic match: "edgestoreweb.edgebrowser.microsoft-staging-falcon.io" Heuristic match: "edgestoreweb.edgebrowser.microsoft-testing-falcon.io" Pattern match: "https://chrome.google.com/webstore" Heuristic match: "*M.et" Heuristic match: "0system_dns_config_change_notifier.cc" Heuristic match: "rowser/shell_integration.cc" Pattern match: "http://permanently-removed.invalid/" Pattern match: "https://permanently-removed.invalid/" Heuristic match: "wus2-000.designerapp.officeapps.live-int.com" Pattern match: "https://designerapp-int.azurewebsites.net/" Heuristic match: "designerapp-dogfood.azurewebsites.net" Heuristic match: "tes.net" Pattern match: "https://designerapp-dogfood.azurewebsites.net/" Heuristic match: "designerapp-int.azurewebsites.net" Heuristic match: "designerapp.edog.officeapps.live.com" Heuristic match: "s.net" Pattern match: "https://designerapp.azurewebsites.net/" Heuristic match: "serial_worker.cc" Pattern match: "https://edge.microsoft.com/" Pattern match: "https://edgeservices.bing.com/" Heuristic match: "designerapp.officeapps.live.com" Heuristic match: "designerapp.azurewebsites.net" Heuristic match: "@rowser/metrics/metrics_reporting_state.cc" Heuristic match: "/tracing/public/cpp/perfetto/perfetto_traced_process.cc" Pattern match: "https://clients2.google.com/service/update2/crx" Pattern match: "https://microsoftedge.microsoft.com/addons" Heuristic match: "chrome.google.com" Heuristic match: "oogle.com" Heuristic match: "devtools.azureedge.net" Heuristic match: ".azureedge.net" Heuristic match: "ntp.msn.com" Heuristic match: "rosoft.com" Heuristic match: "windows.msn.com" Heuristic match: "ft.com" Heuristic match: "ices.bing.com" Pattern match: "www.msn.com" Heuristic match: "_process.cc" Heuristic match: "rowser/edge_startup_boost/edge_startup_boost_manager.cc" Pattern match: "https://permanently-removed.invalid/ClientLogin" Pattern match: "https://permanently-removed.invalid/ServiceLogin" Pattern match: "https://permanently-removed.invalid/OAuthWrapBridge" Pattern match: "https://permanently-removed.invalid/OAuthGetAccessToken" Pattern match: "https://permanently-removed.invalid/oauth/multilogin" Pattern match: "https://permanently-removed.invalid/Logout" Pattern match: "https://permanently-removed.invalid/TokenAuth" Pattern match: "https://permanently-removed.invalid/ServiceLoginAuth" Pattern match: "https://permanently-removed.invalid/chrome/blank.html" Pattern match: "https://permanently-removed.invalid/MergeSession" Pattern match: "https://permanently-removed.invalid/GetUserInfo" Pattern match: "https://www.msn.com/widgets/fullpage/gaming/widget" Pattern match: "https://designerapp.officeapps.live.com/designerapp/static" Pattern match: "https://designerapp.edog.officeapps.live.com/designerapp/static" Pattern match: "https://permanently-removed.invalid/v1/issuetoken" Pattern match: "https://permanently-removed.invalid/reauth/v1beta/users/" Pattern match: "https://permanently-removed.invalid/oauth2/v1/userinfo" Pattern match: "https://permanently-removed.invalid/oauth2/v2/tokeninfo" Pattern match: "https://permanently-removed.invalid/oauth2/v4/token" Pattern match: "https://permanently-removed.invalid/o/oauth2/revoke" Pattern match: "https://permanently-removed.invalid/o/oauth2/auth" Pattern match: "https://permanently-removed.invalid/AddSession" Pattern match: "https://permanently-removed.invalid/OAuthLogin" Pattern match: "https://permanently-removed.invalid/AuthSubRevokeToken" Pattern match: "https://permanently-removed.invalid/v1/events" Heuristic match: "rowser/performance_manager/browser_child_process_watcher.cc" Heuristic match: "browser/screenlock_monitor/screenlock_monitor_device_source_win.cc" Pattern match: "http://edge.microsoft.com/browsernetworktime/time/1/current" Heuristic match: "ts/performance_manager/performance_manager_impl.cc" Pattern match: "https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist" Pattern match: "https://chromereporting-pa.googleapis.com/v1/record" Pattern match: "https://permanently-removed.invalid/devicemanagement/data/api" Pattern match: "https://support.google.com/chrome/?p=plugin_flash" Pattern match: "https://support.google.com/chrome/answer/6258784" Heuristic match: "deo.sy" Heuristic match: "use.sy" Heuristic match: "XE;.BA" Heuristic match: "AT;.CM" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Pattern match: "www.office.comThumbnail" Pattern match: "go.microsoft.com/fwlink/?LinkId=529732Microsoft" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2118167" Pattern match: "go.microsoft.com/fwlink/?linkid=2149872Learn" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2181066Learn" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2187486Downloading" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2165400To" Pattern match: "go.microsoft.com/fwlink/?linkid=2149000https://go.microsoft.com/fwlink/?linkid=2149001Search" Pattern match: "go.microsoft.com/fwlink/?linkid=2172307Get" Pattern match: "aka.ms/requireauthWith" Pattern match: "aka.ms/customprimarypasswordOnce" Pattern match: "go.microsoft.com/fwlink/?linkid=2127457Activity" Pattern match: "go.microsoft.com/fwlink/?linkid=2127863Get" Pattern match: "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://go.microsoft.com/fwlink/?linkid=2137990hereUse" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2115419Learn" Pattern match: "go.microsoft.com/fwlink/?linkid=2164373Ad" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2161865Are" Pattern match: "go.microsoft.com/fwlink/?linkid=529732Manage" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2105403Manage" Pattern match: "go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327Edit" Pattern match: "go.microsoft.com/fwlink/?linkid=2121003Your" Pattern match: "go.microsoft.com/fwlink/?linkid=2101140Change" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=2146263Sync" Pattern match: "www.microsoft.com/rewardsSelected" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2129031Show" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2167671Developer" Pattern match: "https://aka.ms/edgeprintingTroubleshooting" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2146910What" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409PreviousHiHi" Pattern match: "http://Force" Pattern match: "https://chromeenterprise.google/policies/#BrowserSwitcherEnabled" Pattern match: "https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl" Pattern match: "https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist" Pattern match: "https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist" Pattern match: "https://www.facebook.comFacebookhttps://www.youtube.comYouTubehttps://www.wikipedia.orgWikipediahttps://www.reddit.comRedditMicrosoft" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2164373" Pattern match: "microsoftedge.microsoft.com/addons?hl=en&category=themehttps://microsoftedge.microsoft.com/addons?hl=en81ConsolasCambria" Pattern match: "go.microsoft.com/fwlink/?linkid=2174761Share" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2193240Check" Pattern match: "go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" Pattern match: "go.microsoft.com/fwlink/?linkid=2189718Sign" Pattern match: "https://privacy.microsoft.com/privacystatementSign" Pattern match: "go.microsoft.com/fwlink/?linkid=2168605https://go.microsoft.com/fwlink/?linkid=2162539Cheat" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2151738" Pattern match: "http://example.com" Pattern match: "https://go.microsoft.com/fwlink/p/?linkid=2114059" Heuristic match: ",AK.jO" Heuristic match: "xk-.Gi" Heuristic match: "FO.mr" Heuristic match: "%t.kE" Heuristic match: "*0.bV" Heuristic match: "Lq.Ro" Heuristic match: "$%.aW" Heuristic match: "G_P.cf" Heuristic match: "7o.bt" Heuristic match: "*{?.cu" Heuristic match: "RealAudio SIPR / ACELP.NET" Pattern match: "http://www.w3.org/2001/SMIL20/Language" Pattern match: "http://www.w3.org/ns/ttml" Heuristic match: "virtualcamera.ax" Heuristic match: "ycwebcamerasource.ax" Heuristic match: "../../third_party/abseil-cpp/absl/types/bad_optional_access.cc" Heuristic match: "../../third_party/abseil-cpp/absl/types/bad_variant_access.cc" Heuristic match: "C../../base/allocator/partition_allocator/starscan/stats_collector.cc" Heuristic match: "../../third_party/perfetto/src/protozero/scattered_heap_buffer.cc" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/string_table_util.cc" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/throttle_store.cc" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/watson_metadata.cc" Heuristic match: "../../base/files/file_util_win.cc" Heuristic match: "../../base/synchronization/waitable_event_win.cc" Heuristic match: "../../base/threading/platform_thread_win.cc" Heuristic match: "../../base/win/core_winrt_util.cc" Heuristic match: "../../base/win/registry.cc" Heuristic match: "../../base/win/win_util.cc" Heuristic match: "../../base/files/file_enumerator_win.cc" Heuristic match: "../../components/crash/core/app/crashpad.cc" Heuristic match: "../../third_party/crashpad/crashpad/client/crashpad_client_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/client/settings.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/file_io.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/file_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/file_io_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/filesystem_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/scoped_handle.cc" Heuristic match: "../../base/files/file_win.cc" Heuristic match: "blink.net" Heuristic match: "../../base/trace_event/trace_log.cc" Heuristic match: "../../base/native_library_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/client/crash_report_database_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/critical_section_with_debug_info.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/directory_reader_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/file_writer.cc" Heuristic match: "../../base/threading/scoped_blocking_call_internal.cc" Heuristic match: "../../base/metrics/persistent_memory_allocator.cc" Heuristic match: "../../base/metrics/statistics_recorder.cc" Heuristic match: "../../base/win/scoped_winrt_initializer.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/scoped_local_alloc.cc" Pattern match: "crbug.com/1225176" Heuristic match: "../../base/threading/thread.cc" Heuristic match: "../../base/task/thread_pool/thread_group_impl.cc" Heuristic match: "../../base/task/thread_pool/sequence.cc" Pattern match: "Extensions.Database.Open/0x" Heuristic match: "../../base/run_loop.cc" Pattern match: "https://watson.telemetry.microsoft.com" Heuristic match: "../../chrome/app/chrome_exe_main_win.cc" Heuristic match: "../../chrome/app/main_dll_loader_win.cc" Heuristic match: "../../chrome/common/default_browser_channel_util_wcos.cc" Heuristic match: "../../base/allocator/partition_allocator/starscan/stats_collector.cc" Heuristic match: "../../third_party/perfetto/src/protozero/field.cc" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/watson_http_uploader.cc" Pattern match: "https://nw-umwatson.events.data.microsoft.com/Telemetry.Request" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/secondary_data_collectors/file_collector_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/watson_uploader/watson_wer_uploader.cc" Heuristic match: "gcc../../third_party/crashpad/crashpad/watson_uploader/win/device_ticket.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "../../base/file_version_info_win.cc" Heuristic match: "../../base/files/memory_mapped_file_win.cc" Heuristic match: "../../base/trace_event/process_memory_dump.cc" Heuristic match: "../../components/browser_watcher/exit_code_watcher_win.cc" Heuristic match: "[../../third_party/crashpad/crashpad/util/file/file_io.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/watson/memory_csv.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/initial_client_data.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/minidumpwritedump_util.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/net/http_transport_win.cc" Heuristic match: "../../third_party/zlib/google/zip.cc" Heuristic match: "../../base/debug/activity_tracker.cc" Heuristic match: "../../base/win/message_window.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/handler_main.cc" Heuristic match: "../../components/gwp_asan/crash_handler/crash_handler.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/process_info.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/module_version.cc" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Heuristic match: "../../third_party/zlib/google/zip_writer.cc" Heuristic match: "../../third_party/protobuf/src/google/protobuf/message_lite.cc" Heuristic match: "../../third_party/protobuf/src/google/protobuf/arena.cc" Heuristic match: "../../third_party/protobuf/src/google/protobuf/generated_message_util.cc" Heuristic match: "../../base/win/edge_trace_logging/trace_logging.cc" Heuristic match: "../../third_party/crashpad/crashpad/client/prune_crash_reports.cc" Heuristic match: "@../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/session_end_watcher.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/misc/paths_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/win/crash_report_exception_handler.cc" Heuristic match: "gen/components/browser_watcher/activity_report.pb.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/process/process_memory.cc" Heuristic match: "gen/components/gwp_asan/crash_handler/crash.pb.cc" Heuristic match: "../../third_party/protobuf/src/google/protobuf/stubs/common.cc" Heuristic match: "../../sandbox/win/src/sandbox_policy_base.cc" Heuristic match: "../../base/task/sequence_manager/task_queue_impl.cc" Heuristic match: "../../third_party/crashpad/crashpad/client/crash_report_database.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/file/file_seeker.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/minidump/process_snapshot_minidump.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/minidump_to_upload_parameters.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/watson_report_upload.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/thread/thread_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/scoped_set_event.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/win/scoped_process_suspend.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/process_snapshot_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/win/minidumpwritedump_with_crashpad_info.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_file_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/handler/user_stream_data_source.cc" Heuristic match: "../../components/gwp_asan/common/allocator_state.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/synchronization/semaphore_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/minidump/minidump_simple_string_dictionary_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/minidump/module_snapshot_minidump.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/system_snapshot_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/process_reader_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/exception_snapshot_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/module_snapshot_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/process/process_memory_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/memory_snapshot.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_writable.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_thread_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_module_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_unloaded_module_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_handle_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_memory_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_thread_info_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_thread_names_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_writer_util.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/minidump/minidump_string_list_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/minidump/minidump_annotation_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/capture_memory.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/cpu_context_win.cc" Heuristic match: "../../third_party/crashpad/crashpad/util/process/process_memory_range.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/pe_image_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/crashpad_types/crashpad_info_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/pe_image_annotations_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_string_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_context_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_simple_string_dictionary_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_module_crashpad_info_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/process_subrange_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/snapshot/win/pe_image_resource_reader.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_rva_list_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_annotation_writer.cc" Heuristic match: "../../third_party/crashpad/crashpad/minidump/minidump_byte_array_writer.cc" Pattern match: "http://schemas.microsoft.com/SMI/2020/WindowsSettings" Heuristic match: "net/dns/serial_worker.cc" Pattern match: "https://*.bing.com/],tts_engine:{voices:[{codec:audio-24khz-48kbitrate-mono-mp3,event_types:[end,error,start,word],lang:en-US,remote:true,server_name:Microsoft" Heuristic match: "kype.com" Heuristic match: ".*.edu" Pattern match: "https://.onedrive.com" Pattern match: "https://sharepoint.com" Pattern match: "www.bing.com/search" Pattern match: "cn.bing.com/search" Pattern match: "global.bing.com/search" Pattern match: "cn.bing-exp.com/search" Pattern match: "cn.bing-int.com/search" Heuristic match: ".c.bing.com" Pattern match: "https://box.com" Heuristic match: "con16.pn" Pattern match: "https://*/*" Pattern match: "http://*/*" Pattern match: "https://*.bing.com/" Pattern match: "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms" Heuristic match: "gger.cc" Heuristic match: "su.edu" Heuristic match: "ing.com" Pattern match: "https://*.bing.com/*]},creation_flags:1,events:[ttsEngine.onPause,ttsEngine.onResume,ttsEngine.onSpeak,ttsEngine.onStop],from_webstore:false,install_time:13295640815778034,location:5,manifest:{background:{persistent:false,script" Heuristic match: "pwin/session_change_observer.cc" Heuristic match: "ablog.blogspot.com" Heuristic match: "arq.blogspot.com" Heuristic match: "gspot.com" Heuristic match: "games.blogspot.com" Heuristic match: "on.blogspot.com" Heuristic match: "ot.com" Heuristic match: "uela7.blogspot.com" Heuristic match: "spot.com" Heuristic match: "logspot.com" Heuristic match: "ogspot.com" Heuristic match: "bpics.blogspot.com" Heuristic match: "in-marathi.blogspot.com" Heuristic match: "pot.com" Heuristic match: "lm.blogspot.com" Heuristic match: "cm.g.doubleclick.net" Heuristic match: ".doubleclick.net" Heuristic match: "cat.da.us.criteo.com" Heuristic match: "da.us.criteo.com" Heuristic match: "l.clarity.ms" Heuristic match: "arity.ms" Heuristic match: "idsync.rlcdn.com" Heuristic match: "nc.rlcdn.com" Heuristic match: "hbx.media.net" Heuristic match: "media.net" Heuristic match: "eb2.3lift.com" Heuristic match: "3lift.com" Heuristic match: "pix.us.criteo.net" Heuristic match: "us.criteo.net" Heuristic match: "pippio.com" Heuristic match: "io.com" Heuristic match: "m.adnxs.com" Heuristic match: "nxs.com" Heuristic match: "lax1-ib.adnxs.com" Heuristic match: "-ib.adnxs.com" Heuristic match: "s.yimg.com" Heuristic match: "mg.com" Heuristic match: "px.ads.linkedin.com" Heuristic match: "ds.linkedin.com" Heuristic match: "pr-bh.ybp.yahoo.com" Heuristic match: "h.ybp.yahoo.com" Pattern match: "www.clarity.ms" Heuristic match: "clarity.ms" Heuristic match: "ts/leveldb_proto/internal/proto_leveldb_wrapper.cc" Heuristic match: "ed_process.cc" Heuristic match: "tmath.co" Heuristic match: "lcdn.com" Heuristic match: "profile.content_settings.exceptions.ar" Heuristic match: "profile.default_content_setting_values.ar" Pattern match: "badssl.com/test/safety-tips/allowed" Heuristic match: "indiansexbazar.com" Heuristic match: "bp`box.com" Pattern match: "api.box.com/oauth2/token" Pattern match: "account.box.com/api/oaut" Heuristic match: "enterprise_connectors.file_system.box.folder.id" Heuristic match: "box.com" Heuristic match: "boxcloud.com" Pattern match: "https://api.box.com/oauth2/token" Pattern match: "https://account.box.com/api/oauth2/authorize" Pattern match: "https://cat.da.us.criteo.com:443,*" Pattern match: "https://cm.g.doubleclick.net:443,*" Pattern match: "https://px.ads.linkedin.com:443,*" Pattern match: "https://pr-bh.ybp.yahoo.com:443,*" Pattern match: "https://tags.rd.linksynergy.com:443,*" Pattern match: "https://sb.scorecardresearch.com:443,*" Pattern match: "www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%20Issuing%20CA%2005%20-%20xsign.crt0-" Pattern match: "http://oneocsp.microsoft.com/ocsp0" Pattern match: "www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl0f" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm0" Pattern match: "https://ris.api.iris.microsoft.com/v1/a/{ACTION}?PG=IRIS000001.0000000244&UNID=88000244&CID=128000000002116929&PID=425132753&TargetID=700344123&REQASID=1703999D3AD140C0DD2896CD67710D43&ASID=9cb1bf4520db4fa8ba3e00793b483b90&REQT=20220801T141523&UIT=E&ID=-58" Pattern match: "http://*/*,https://*/*],manifest_permissions:[]},commands:{},content_settings:[],creation_flags:1,events:[runtime.onConnectExternal],from_webstore:false,incognito_content_settings:[],incognito_preferences:{},install_time:13295640815" Pattern match: "https://arc.msn.com/v3/Delivery/Events/Impression?PID=425132753&TID=700344123&CID=128000000002116929&BID=610271703&PG=IRIS000001.0000000244&TPID=425132753&REQASID=1703999D3AD140C0DD2896CD67710D43&ASID=9cb1bf4520db4fa8ba3e00793b483b90&SLOT=1&REQT=20220801T1" Heuristic match: "profile.name" Heuristic match: "enterprise_connectors.file_system.box.folder.name" Pattern match: "https://permanently-removed.invalid/safebrowsing/uploads/scan" Pattern match: "https://ntp.msn.com:443,*" Pattern match: "https://m.adnxs.com:443,*" Pattern match: "https://lax1-ib.adnxs.com:443,*" Pattern match: "https://l.clarity.ms:443,*" Pattern match: "https://idsync.rlcdn.com:443,*" Pattern match: "https://hbx.media.net:443,*" Pattern match: "https://eb2.3lift.com:443,*" Pattern match: "https://microsoft.test:443,*" Pattern match: "https://ntp|msn|com/" Pattern match: "https://www.clarity.ms:443,*" Pattern match: "https://s.yimg.com:443,*" Pattern match: "https://pix.us.criteo.net:443,*" Pattern match: "https://pippio.com:443,*" Pattern match: "https://*.microsoftstream.com/*" Pattern match: "https://*.officeapps.live.com/*" Pattern match: "https://*.teams.live.com/*" Pattern match: "https://*.teams.microsoft.com/*" Pattern match: "https://*.microsoft.com/*" Heuristic match: "designer.ecosystem.id" Heuristic match: "Naturalprofile.name" Heuristic match: "extensions.theme.id" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqHh?ver=0f07" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wtc3?ver=79e5" Pattern match: "search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms" Heuristic match: "ts/edge_nurturing/core/common/campaign_history_manager/campaign_history_backend.cc" Heuristic match: "bluetooth_api.cc" Pattern match: "https://www.bing.com/search?q=Rawu%2C+Tibet&filters=IsConversation%3a%22True%22+BTEPKey:%22Encyclo_WL_RanwuLakeQamdoTibet%22&form=M00001" Pattern match: "https://*.google.com/*" Pattern match: "https://*.skype.com/*" Pattern match: "https://*word-edit.gov.online.office365.us/*" Pattern match: "https://*powerpoint.gov.online.office365.us/*" Pattern match: "https://*onenote.gov.online.office365.us/*" Pattern match: "https://*excel.gov.online.office365.us/*" Pattern match: "https://*word-edit.partner.officewebapps.cn/*" Pattern match: "https://*powerpoint.partner.officewebapps.cn/*" Pattern match: "https://*onenote.partner.officewebapps.cn/*" Pattern match: "https://*excel.partner.officewebapps.cn/*" Pattern match: "https://*word-edit.officeapps.live.com/*" Pattern match: "https://*onenote.officeapps.live.com/*" Pattern match: "https://*powerpoint.officeapps.live.com/*" Pattern match: "https://*excel.officeapps.live.com/*" Pattern match: "https://*.whiteboard.office365.us/*" Pattern match: "https://*.app.int.whiteboard.microsoft.com/*" Pattern match: "https://*.whiteboard.office.com/*" Pattern match: "https://*.app.whiteboard.microsoft.com/*" Pattern match: "https://*.dod.online.office365.us/*" Pattern match: "https://*.partner.officewebapps.cn/*" Pattern match: "https://*.gov.online.office365.us/*" Pattern match: "https://*visio.dod.online.office365.us/*" Pattern match: "https://*visio.gov.online.office365.us/*" Pattern match: "https://*visio.partner.officewebapps.cn/*" Pattern match: "https://*word-edit.dod.online.office365.us/*" Pattern match: "https://*powerpoint.dod.online.office365.us/*" Pattern match: "https://*onenote.dod.online.office365.us/*" Pattern match: "https://*excel.dod.online.office365.us/*" Pattern match: "https://microsoftedge.microsoft.com" Pattern match: "https://*.bing.com/*" Heuristic match: "es/important_file_writer.cc" Heuristic match: "idsync.rlcdn.co" Heuristic match: "tags.rd.linksynergy.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "@linksynergy.com"2b:T498,"other {Some of these files are encrypted. Ask their owner to decrypt.}}Your administrator says: "$1"$1 has sensitive or dangerous data. Your administrator says: "$2"Discard filePlease enter a reason for uploading this data:Scan in progress, open now?An unknown file is being scanned for dangerous content.Scan file before opening?$1 may be dangerous. Advanced Protection recommends sending this file to Microsoft to check for malware.Timed outSomething went wrong. Scanning could not be completed. Please try again.Scan againStoring $1 Authentication TokenUpon signing in, an unique authentication token will be stored and used for all future eligible downloads.Sign into $1 to complete downloadYour organization requires eligible downloads to be saved to $1. Upon signing in, an unique authentication token will be stored and used for all future eligible downloads.Cancel downloadLink $1 account for DownloadsSpeech recognition service{NUM_EXTENSIONS, plural," (Source: 00000000-00006360.00000000.76603.0DD60000.00000002.mdmp, 00000000-00006360.00000001.78520.0DD60000.00000002.mdmp, 00000000-00006360.00000002.80443.0DD60000.00000002.mdmp, Indicator: "files are encrypted")2c:T5f8,"t contain malware threatsReport that this is not a scam siteContinue to the unsafe site (not recommended)Microsoft SecurityMicrosoft Defender SmartScreen blocked this web content because it was reported as unsafe.You're blocked from continuing to this site. For more info, contact your organization.Website blocked by your organizationThis website is blocked by your organization. Contact your administrator for more information.This web content has been blocked by your administrator.Content blocked by your organizationThis content is blockedThis content has been blocked by your organization.Security errorThe site ahead contains malwareAttackers currently on $1 might attempt to install dangerous programs on your computer that steal or delete your information (for example, photos, passwords, messages, and credit cards). Learn moreGoogle Safe Browsing recently detected malware on $1. Websites that are normally safe are sometimes infected with malware.Google Safe Browsing recently detected malware on $1. Websites that are normally safe are sometimes infected with malware. The malicious content comes from $2, a known malware distributor.If you understand the risks to your security, you may visit this unsafe site before the dangerous programs have been removed.Not used in code: task# 21061940To get Chrome" (Indicator: "the site ahead contains malware")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790689518604,"unified_at":"2026-09-29T13:45:18.604Z","metadata":{"hashes":{"sha256":"7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5","sha1":"76f3f377aa66f9beaa8a103a4dd67f4fdcbeaa0d","md5":"ec3c0d9cbf4e27e0240c5b5d888687ec","sha512":"af3c54c21b140ff22dff066a3ede1c3693fae3c8740c563643af827c1cd403c3ad0905f86a745b2d5162a2793719e6bf6498f6d51ecb8dd51ec46e4a5673e880","ssdeep":"768:KV816MhnjtEACNBUNDBCHdzP9Jn2IP2jk:xjtPGBUNDIzPzn7","ssdeep_chunks":["768:KV816Mh","768:V816Mhn","768:816Mhnj","768:16Mhnjt","768:6MhnjtE","768:MhnjtEA","768:hnjtEAC","768:njtEACN","768:jtEACNB","768:tEACNBU","768:EACNBUN","768:ACNBUND","768:CNBUNDB","768:NBUNDBC","768:BUNDBCH","768:UNDBCHd","768:NDBCHdz","768:DBCHdzP","768:BCHdzP9","768:CHdzP9J","768:HdzP9Jn","768:dzP9Jn2","768:zP9Jn2I","768:P9Jn2IP","768:9Jn2IP2","768:Jn2IP2j","768:n2IP2jk","1536:KV816Mh","1536:V816Mhn","1536:816Mhnj","1536:16Mhnjt","1536:6MhnjtE","1536:MhnjtEA","1536:hnjtEAC","1536:njtEACN","1536:jtEACNB","1536:tEACNBU","1536:EACNBUN","1536:ACNBUND","1536:CNBUNDB","1536:NBUNDBC","1536:BUNDBCH","1536:UNDBCHd","1536:NDBCHdz","1536:DBCHdzP","1536:BCHdzP9","1536:CHdzP9J","1536:HdzP9Jn","1536:dzP9Jn2","1536:zP9Jn2I","1536:P9Jn2IP","1536:9Jn2IP2","1536:Jn2IP2j","1536:n2IP2jk","768:xjtPGBU","768:jtPGBUN","768:tPGBUND","768:PGBUNDI","768:GBUNDIz","768:BUNDIzP","768:UNDIzPz","768:NDIzPzn","768:DIzPzn7"],"imphash":"Unknown"},"file_info":{"file_name":"bounty-65031670637844130","file_type":["html"],"file_type_id":"html","file_size":25229,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1679312448000,"last_seen":1680045303000,"last_multi_scan":1680045303000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":18,"suspicious_count":2,"malicious_count":2,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/VBS.Kimsuky.S1997","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VBS:Electryon.58","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VBS:Electryon.58 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/TrojanDownloader.Agent.YND trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains reference to Base64 character set"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Found registry location string related to BIOS"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops script (vb/js) files"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains reference to Base64 character set","description":"Observed Base64 character set (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\") in Source: 00000000-00006360.00000000.76603.11F77000.00000002.mdmp\n 00000000-00006360.00000001.78520.11F77000.00000002.mdmp\n 00000000-00006360.00000002.80443.1011E000.00000002.mdmp\n 00000000-00006360.00000002.80443.11F77000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$25","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00006360.00000000.76603.40C76000.00000002.mdmp\n 00000000-00006360.00000001.78520.40C76000.00000002.mdmp\n 00000000-00006360.00000002.80443.40C76000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00006360.00000000.76603.40C76000.00000002.mdmp\n 00000000-00006360.00000001.78520.40C76000.00000002.mdmp\n 00000000-00006360.00000002.80443.40C76000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:120:WilError_01\"\n \"Local\\SM0:6360:304:WilStaging_02\"\n \"Local\\SM0:6360:120:WilError_01\"\n \"SM0:6360:304:WilStaging_02\"\n \"ChromeProcessSingletonStartup!\"\n \"SM0:6360:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"0@e.n\"\n Pattern match: \"rrf@0.53\"\n Pattern match: \"rf@0.53\"\n Pattern match: \"rrf@0.11\"\n Pattern match: \"rf@0.11\"\n Pattern match: \"rrf@0.99\"\n Pattern match: \"rf@0.99\"\n Pattern match: \"rrf@0.78\"\n Pattern match: \"rf@0.78\"\n Pattern match: \"rrf@0.26\"\n Pattern match: \"rf@0.26\"\n Pattern match: \"rrf@0.25\"\n Pattern match: \"rf@0.25\"\n Pattern match: \"rrf@0.13\"\n Pattern match: \"rf@0.13\"\n Pattern match: \"rrf@0.17\"\n Pattern match: \"rf@0.17\"\n Pattern match: \"rrf@0.66\"\n Pattern match: \"rf@0.66\"\n Pattern match: \"rrf@0.36\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$26","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - CHROME_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\LOCAL\\crashpad_6360_ZSKIQXLCVIZWTBEC\n Found string - \\\\.\\pipe\\LOCAL\\crashpad_6360_ZSKIQXLCVIZWTBEC\n Found string - \\\\.\\pipe\\LOCAL\\crashpad_%lu_\n Found string - \\\\.\\pipe\\%ls\\%ls\n Found string - \\Dev\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Applicati\\\\.\\pipe\\LOCAL\\chrome.sync.\n Found string - \\\\.\\pipe\\LOCAL\\edge.sync.\n Found string - \\\\.\\pipe\\LOCAL\\chrome.sync.\n Found string - \\\\\\\\.\\pipe\\LOCAL\\edge.sync.\n Found string - \\\\.\\pipe\\\\??\\pipe\\chrome.\n Found string - \\\\.\\pipe\\LOCA\\??\\pipe\\edge.\n Found string - \\\\\\\\.\\pipe\\\\??\\pipe\\chrome.\n Found string - \\Dev\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\\\.\\pipe\\LOCAL\\edge.sync.\n Found string - \\Dev\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\\\.\\pipe\\\\??\\pipe\\chrome.","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$27","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops script (vb/js) files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-40","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"suppliersmx.smp-automotive.com\" [Source: 00000000-00006360.00000000.76603.002E4000.00000004.mdmp\n 00000000-00006360.00000001.78520.01240000.00000004.mdmp\n 00000000-00006360.00000002.80443.01240000.00000004.mdmp]\n Observed email domain:\"mx._\" [Source: 00000000-00006360.00000000.76603.0FA60000.00000002.mdmp\n 00000000-00006360.00000001.78520.0FA60000.00000002.mdmp\n 00000000-00006360.00000002.80443.0FA60000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$29","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00006360.00000000.76603.130AD000.00000002.mdmp\n 00000000-00006360.00000001.78520.130AD000.00000002.mdmp\n 00000000-00006360.00000002.80443.130AD000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00006360.00000000.76603.0DAD0000.00000004.mdmp\n 00000000-00006360.00000001.78520.0DAD0000.00000004.mdmp\n 00000000-00006360.00000001.78520.12360000.00000004.mdmp\n 00000000-00006360.00000002.80443.0DAD0000.00000004.mdmp\n 00000000-00006360.00000002.80443.12360000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"kyc.icicibank.com\" (Source: 00000000-00006360.00000000.76603.0031C000.00000004.mdmp, 00000000-00006360.00000001.78520.00E0C000.00000004.mdmp, 00000000-00006360.00000001.78520.01254000.00000004.mdmp, 00000000-00006360.00000002.80443.00E0C000.00000004.mdmp, 00000000-00006360.00000002.80443.01254000.00000004.mdmp, Indicator: \"icicibank.com\")\n \"buy.icicibank.com\" (Source: 00000000-00006360.00000000.76603.0031C000.00000004.mdmp, 00000000-00006360.00000001.78520.00E0C000.00000004.mdmp, 00000000-00006360.00000001.78520.01254000.00000004.mdmp, 00000000-00006360.00000002.80443.00E0C000.00000004.mdmp, 00000000-00006360.00000002.80443.01254000.00000004.mdmp, Indicator: \"icicibank.com\")\n \"bmo.com\" (Source: 00000000-00006360.00000000.76603.0031C000.00000004.mdmp, 00000000-00006360.00000001.78520.00E0C000.00000004.mdmp, 00000000-00006360.00000001.78520.01254000.00000004.mdmp, 00000000-00006360.00000002.80443.00E0C000.00000004.mdmp, 00000000-00006360.00000002.80443.01254000.00000004.mdmp, Indicator: \"bmo.com\")","origin":"File/Memory","relevance":10,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/59 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PDF file referenced an URL that was taken down due to TOS violation","description":"$2c","origin":"File/Memory","relevance":10,"id":"string-26","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/59 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":150,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":115,"files_deleted_count":0,"registry_keys_created_count":28,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":28,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"642375a79b26310791071f7f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VBS:Electryon.58","submit_name":"bounty-65031670637844130","analysis_start_time":"2023-03-28T23:33:25+00:00","indicators_count":{"informative":18,"suspicious":2,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}],"processes":[{"pid":6360,"ppid":0,"name":"msedge.exe","command_line":"--single-argument C:\\7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5.html","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00006360","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACk0lEQVR4Xu2W2Y7aQBBF58cTDfsyBrODzb7+EC+Zh4l4QQGBhIQUdqj4GtpuGmMolLfE0tUwGo3PqaK7ut/e/j8eT7/fJ6TX61G326VOp0Ptdoda7Ta1Wi1qNpvUaDSoXm9QrV6naq1GZrVKplklwzCpbv2tUCiQ+t6nH8CPx+NNDnIOag50Op1oMBjQaDSypV6WQOUA7vd72iE7kR1tRbbnn5utyNaWgMByuaSvr59kmCbpr0ig7V4CDhyffQQWiwXN53P68flJ5YpBuq7zJPCdQ8CGewkA7oBvBWazGU2nUxqPxzQcDqlUKvMEsOAcgXvtl8CqgKZpV8nkcjwBrHZbwIH7tH/jCuDzxKr810RkYnVjTplslilgbTUh4IIluEf7hcBaznpjraMD6RmmAPY5ttpDuFL9tcDGEUjrGZ4AhsxZAB1wwdcrX4J7VW8JrC4CqTRzF2DCYbh4g/G7gPtXLwS0dJongPFqd0ABX7f9HtytXgh8pFI8AYxRdOAG7MDdtnvBRfWOgMYUwMGCPe1AZBEGXAgkPzSmgAkBuQMXqC98ewM/C+wpkfzgCeBIdTqgQD3BHpWLYJrGk0meQMUwzgIS1BvsD1+t1rZALMEUKFcqtLcEbmFq/OG/LwLReIInUCqXHwicwY/gjkAszhMollSBjRs/sAIXApFojClQLNnbR8AeQi+RwbJAOBrlCRSKRVtABdyNB1gWCEWYAnnrHveUgAdQDQSC4QhPIJf3E1g/BZYFAqEwTyCby9sTTMA4QDW2QDDEE8AdDv+ovuyV4D3vbAHrDufciP9CvgeCPAHc4XCNwk0Glwmc5zhScarhYMFsx3jFhMOQwT7HVsNqx4LDd462o3LAv70HeAL/1PMHltdlzrwAwvsAAAAASUVORK5CYII="},{"pid":3684,"ppid":6360,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=103.0.5060.53 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=103.0.1264.37 --initial-client-data=0xd4,0xd8,0xdc,0xa4,0x148,0x7ffd130e90b8,0x7ffd130e90c8,0x7ffd130e90d8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00003684"},{"pid":6420,"ppid":6360,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:2","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00006420"},{"pid":5852,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1920 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:3","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00005852"},{"pid":3304,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00003304"},{"pid":1296,"ppid":6360,"name":"msedge.exe","command_line":"--type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --launch-time-ticks=1219123896 --mojo-platform-channel-handle=3052 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:1","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00001296"},{"pid":3200,"ppid":6360,"name":"msedge.exe","command_line":"--type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --launch-time-ticks=1220612038 --mojo-platform-channel-handle=3060 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:1","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00003200"},{"pid":4068,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4132 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00004068"},{"pid":4612,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00004612"},{"pid":2260,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00002260"},{"pid":2592,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00002592"},{"pid":3944,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00003944"},{"pid":4340,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5092 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00004340"},{"pid":6616,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00006616"},{"pid":2368,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5376 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00002368"},{"pid":6712,"ppid":6360,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:2","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00006712"},{"pid":2152,"ppid":6360,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4988 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:8","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00002152"},{"pid":4040,"ppid":6360,"name":"msedge.exe","command_line":"--type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --launch-time-ticks=1520911647 --mojo-platform-channel-handle=4052 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:1","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00004040"},{"pid":6876,"ppid":6360,"name":"msedge.exe","command_line":"--type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --launch-time-ticks=1521884045 --mojo-platform-channel-handle=5396 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:1","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00006876"},{"pid":5108,"ppid":6360,"name":"msedge.exe","command_line":"--type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --launch-time-ticks=1523224882 --mojo-platform-channel-handle=5488 --field-trial-handle=1984,i,18239362905835055353,8956440930056799061,131072 /prefetch:1","sha256":"79516254cb513e93765c55135288cc1d3fa46c2e800aed017582e57694836136","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006360","uid":"00000000-00005108"}],"all_imported_dlls":["dmcmnutils.dll","DataExchange.dll","d3d11.dll","d3dcompiler_47.dll","msedge_elf.dll","kernel.appcore.dll","KBDUS.DLL","mdmregistration.dll","winhttp.dll","netprofm.dll","sspicli.dll","dxilconv.dll","fwbase.dll","gdi32full.dll","npmproxy.dll","twinapi.dll","oleaccrc.dll","directmanipulation.dll","rsaenh.dll","rpcrt4.dll","cryptbase.dll","combase.dll","oleaut32.dll","dpapi.dll","mswsock.dll","CompPkgSup.dll","libGLESv2.dll","dbghelp.dll","winmmbase.dll","OneCoreCommonProxyStub.dll","uxtheme.dll","ws2_32.dll","msctf.dll","fwpolicyiomgr.dll","srumapi.dll","profapi.dll","wintrust.dll","propsys.dll","telclient.dll","advapi32.dll","mscms.dll","cryptnet.dll","ffmpeg.dll","dsreg.dll","RTWorkQ.dll","BitsProxy.dll","user32.dll","twinapi.appcore.dll","netutils.dll","iertutil.dll","aepic.dll","SHCore.dll","rmclient.dll","comctl32.dll","dxva2.dll","wlanapi.dll","vulkan-1.dll","CoreUIComponents.dll","vaultcli.dll","actxprxy.dll","msvproc.dll","vk_swiftshader.dll","dnsapi.dll","ucrtbase.dll","gpapi.dll","winsta.dll","Windows.Networking.Connectivity.dll","msvcp_win.dll","bcrypt.dll","CoreMessaging.dll","FWPUCLNT.DLL","crypt32.dll","IPHLPAPI.DLL","secur32.dll","tbs.dll","onramp.dll","cldapi.dll","win32u.dll","windows.storage.dll","dwmapi.dll","userenv.dll","UIAutomationCore.dll","wldp.dll","mfplat.dll","D3D12.dll","ntdll.dll","shlwapi.dll","oleacc.dll","FirewallAPI.dll","Windows.Security.Authentication.OnlineId.dll","bcryptprimitives.dll","setupapi.dll","Windows.Web.dll","rasadhlp.dll","shell32.dll","cfgmgr32.dll","winmm.dll","Windows.UI.dll","msvcp110_win.dll","Windows.Security.Authentication.Web.Core.dll","libEGL.dll","clbcatq.dll","msvcrt.dll","gdi32.dll","dxgi.dll","mfperfhelper.dll","KernelBase.dll","ntmarta.dll","devobj.dll","d3d10warp.dll","wkscli.dll","nsi.dll","rpcss.dll","WinTypes.dll","microsoft_apis.dll","dcomp.dll","oneds.dll","dhcpcsvc.dll","TextInputFramework.dll","wtsapi32.dll","netapi32.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","mf.dll","version.dll","fltLib.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","DWrite.dll","dhcpcsvc6.dll","atlthunk.dll","ncrypt.dll","Windows.Media.dll","cryptsp.dll","imm32.dll","powrprof.dll","ntasn1.dll","nlaapi.dll","mfsensorgroup.dll","DolbyDecMFT.dll","sechost.dll","edputil.dll","kernel32.dll","VxSSL64.dll","OneCoreUAPCommonProxyStub.dll","linkinfo.dll","PCPKsp.dll","ResourcePolicyClient.dll","msmpeg2vdec.dll","ole32.dll","msedge.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"widevinecdm.dll","sha256":"db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"7c64e573-0ed9-4aa3-a544-f29519234cbe.tmp","sha256":"8ec3396320a622ed69ef069b8a8613f85cffba37a818c47a154a5a2f114c0b82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"3d276ce3-b316-4bf9-b8f7-8afb61beb09d.tmp","sha256":"8684917719f772937cd2112a839bf3939bfedb995837720fbe7f6967372ac1a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"46a6de8e-84d4-4631-a985-b722e7614832.tmp","sha256":"2889cebe4614a96f39d00565340d81147320e8fc4c5eb3a730178fe6b771e8c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"4fb89caf-30c2-4ba6-8e25-2e001d7cd9b6.tmp","sha256":"e610966c6a85abae64adac8b635753423a0b1378024b3792110d6bd30954f68a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"67d82b73-3c3c-4c2c-bd37-793fb6223e40.tmp","sha256":"0c3b79999568da9c0041a33159c205779448b04ec869b53ae41eca6d6f7ae9e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"73a65cbd-d99e-48ee-8a48-34f3dc6a6030.tmp","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"849d1dbc-f786-42c0-8966-aa1e0fa50de3.tmp","sha256":"8684917719f772937cd2112a839bf3939bfedb995837720fbe7f6967372ac1a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"8e23e6a1-f7cb-41cf-8c30-6992fe1817bb.tmp","sha256":"91ba00eaee66aa5a4ca30bc4f5c878bffedc7c867c9dbdd4c8b5e54ba199bb87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"d5c96c32-97e7-4509-be03-bb645e621739.tmp","sha256":"a83af35a26376dc54ef43fca5ce58906a08dc32ff0dd4007c331b6dee4e5b9e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"edge_autofill_field_data.json","sha256":"5f3a7426de195d7c991aeabad4886e7dad32ff30bcfb4058745a1accc96a64d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"edge_autofill_global_block_list.json","sha256":"0897465fac64fc4c25446370aedb21f985009348c01b261b919d9f1062457e98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"regex_patterns.json","sha256":"0f8981b5bb10039061a861aef0da28223174056abe293792039f59dea84201ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"crl-set","sha256":"a9d07f29ecef87d24fb565b022b5c55524be4dfb09a513954aa7f5c6b960ce6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"settings.dat","sha256":"cd56751d0d27cdfeb2a397e48b9a2f56f9941ef6540e97684d0bf440523739fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"06b1a7b3-f6f6-4b4b-b92c-80cad9196fa7.tmp","sha256":"8fc75887881e12f80d67fdb5ddaf47391527ddec16cb9b12df247759a5f68f5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"12fbe028-79dd-46c0-8f1e-214aceb0e679.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"25b75369-7036-484f-b65f-f6da3c3aa6a0.tmp","sha256":"bf3f3233af2c12730dbb0a0de53b185823fe1cf3f74b208feba17183ea91bbfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"4691fff8-ac63-4745-8ce6-6fe3a2549740.tmp","sha256":"8fc75887881e12f80d67fdb5ddaf47391527ddec16cb9b12df247759a5f68f5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"76758086-dee3-47e2-ba7d-2ed52c834692.tmp","sha256":"522640eceaa203549df294371c666e968615f07ce988f4440374356c97785440","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"958b26b3-13f4-4f38-8b1b-512bde9cc90b.tmp","sha256":"8ec3396320a622ed69ef069b8a8613f85cffba37a818c47a154a5a2f114c0b82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\BrowserMetrics-64237A7E-18D8.pma","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\lockfile","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Version","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Top Sites","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\000004.log","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\000003.log","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\load_statistics.db-wal","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\load_statistics.db-shm","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\ba14aaa1-6a09-46be-8802-2c95740b1c6d.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\f2475496-d3a7-4aad-abf9-01748b8d89a0.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AssistanceHome\\AssistanceHomeSQLite","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\heavy_ad_intervention_opt_out.db","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\f3d69ed3-0fcf-47ad-a1cf-ba55deb2206b.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shortcuts","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Browser","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_model_metadata_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\optimization_guide_hint_cache_store\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_892483231\\crl-set","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_892483231\\manifest.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\adblock_snippet.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Filtering Rules","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Filtering Rules-AA","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\LICENSE","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-DE","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-ES","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-FR","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-IT","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-NL","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-RU","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\Part-ZH","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_1215131385\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Subresource Filter\\Indexed Rules\\35\\scoped_dir6360_1395114300\\Ruleset Data","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2093929213\\_metadata\\verified_contents.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2093929213\\_platform_specific\\win_x64\\widevinecdm.dll","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2093929213\\_platform_specific\\win_x64\\widevinecdm.dll.sig","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2093929213\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2043098434\\edge_autofill_field_data.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2043098434\\edge_autofill_global_block_list.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2043098434\\regex_patterns.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_2043098434\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_253443551\\safety_tips.pb","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_253443551\\typosquatting_list.pb","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_253443551\\_metadata\\verified_contents.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_253443551\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\auto_open_controller.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\edge_checkout_page_validator.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\edge_confirmation_page_validator.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\edge_driver.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\edge_tracking_page_validator.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\product_page.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\shopping.html","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\shopping.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\shoppingfre.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\shopping_fre.html","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\shopping_iframe_driver.js","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_934385778\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_120246096\\deny_domains.list","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\6360_120246096\\manifest.fingerprint","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\DashTrackerDatabase","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\DashTrackerDatabase-journal","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\LOG","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\a1943c8d-7fed-4f1a-bc9a-5e6ee961a42e.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\1a2c42c7-10b4-4a09-b70a-6b820a753d75.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\domains_config.json","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%TEMP%\\1fe488f1-7e21-4c89-9c78-0e04ea436ce7.tmp","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Variations","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Feature Engagement Tracker\\EventDB\\LOG.old~RF17b268.TMP","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"Local\\SM0:6360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"SM0:6360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6360:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"Local\\SM0:5852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"SM0:5852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"Local\\SM0:6712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]},{"name":"SM0:6712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"642375a79b26310791071f7f"}]}]}},"report_ids":{"sandbox_job_ids":["642375a79b26310791071f7f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 7a45a529b275… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7a45a529b275…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 7a45a529b275… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7a45a529b275…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7a45a529b275cfaa6ebde88bf00413a11c0f701bf9e1e7e93ef27423fd17e3f5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 7a45a529b275… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7a45a529b275…. Threat score 100/100. 6/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]