25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T600,file/memory contains long string with (Indicator: "facebook.com"; File: "Social") Found string "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" (Indicator: "youtube"; File: "Fingerprinting") Found string "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" (Indicator: "youtube"; File: "Other") Found string "ads-twitter.com/" (Indicator: "twitter"; File: "Advertising") Found string "linkedin.com^Microsoft" (Indicator: "linkedin.com"; File: "Entities") Found string "facebook.com^Facebook" (Indicator: "facebook.com"; File: "Entities") Found string "youtube.com^Google" (Indicator: "youtube"; File: "Entities") Found string "tweetdeck.com^Twitter" (Indicator: "twitter"; File: "Entities") Found string "fabric.io^Twitter" (Indicator: "twitter"; File: "Entities") Found string "digits.com^Twitter" (Indicator: "twitter"; File: "Entities") Found string "twitter.com^Twitter" (Indicator: "twitter"; File: "Entities") Found string "paypal.com^Paypal" (Indicator: "paypal"; File: "Entities") Found string "simility.com^Paypal" (Indicator: "paypal"; File: "Entities") Found string "twittercounter.com^Twitter Counter" (Indicator: "twitter"; File: "Entities") Found string "ads-twitter.com^Twitter" (Indicator: "twitter"; File: "Entities") Found string "twitter.jp^Twitter" (Indicator: "twitter"; File: "Entities") Found string "twimg.com^Twitter" (Indicator: "twitter"; File: "Entities")27:T491,Found string "

" (Indicator: "text/javascript"; File: "urlref_httpsatmoviesdotonline.blogspot.com") Found string "" (Indicator: "text/javascript"; File: "urlref_httpsatmoviesdotonline.blogspot.com")28:T5577,"urlref_httpsatmoviesdotonline.blogspot.com" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00008156] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00008156] "recovery-component-inner.crx" has type "Google Chrome extension version 3"- Location: [%TEMP%\5080_690854535\recovery-component-inner.crx]- [targetUID: 00000000-00005080] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00008156] "v1FieldTypes.json" has type "JSON data"- Location: [%TEMP%\5080_1533544290\v1FieldTypes.json]- [targetUID: 00000000-00005080] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00005080] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00005080] "load_statistics.db" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00005080] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00008156] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00008156] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00008156] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00008156] "36d5fefc-8923-4742-88c9-61c81915b7d1.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 384543"- Location: [%TEMP%\36d5fefc-8923-4742-88c9-61c81915b7d1.tmp]- [targetUID: 00000000-00005080] "edge_autofill_field_data.json" has type "JSON data"- Location: [%TEMP%\5080_1533544290\edge_autofill_field_data.json]- [targetUID: 00000000-00005080] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00006152] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00005080] "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00005080] "f_0004cc" has type "gzip compressed data max compression original size modulo 2^32 384543"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cc]- [targetUID: 00000000-00008156] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00008156] "f_0004c8" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1200x900 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c8]- [targetUID: 00000000-00008156] "f_0004c6" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 Exif Standard: [TIFF image data little-endian direntries=1 software=Google] baseline precision 8 640x360 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00008156] "6565f919-bfa4-467d-9db1-90e40b3e06f3.tmp" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\6565f919-bfa4-467d-9db1-90e40b3e06f3.tmp]- [targetUID: 00000000-00005080] "Tabs_13347745832092439" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13347745832092439]- [targetUID: 00000000-00005080] "Diagnostic Data-wal" has type "SQLite Write-Ahead Log version 3007000"- [targetUID: N/A] "Entities" has type "UTF-8 Unicode text"- Location: [%TEMP%\5080_872551854\Mu\Entities]- [targetUID: 00000000-00008156] "5e4a230e-fc0c-4d38-9337-1fb9305a0453.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 136857"- Location: [%TEMP%\5e4a230e-fc0c-4d38-9337-1fb9305a0453.tmp]- [targetUID: 00000000-00005080] "5c3446b4-066b-4e55-bf9c-71951adbd1ab.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5c3446b4-066b-4e55-bf9c-71951adbd1ab.tmp]- [targetUID: 00000000-00005080] "b0fa0349-3820-41eb-8e06-8b373fc861f8.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b0fa0349-3820-41eb-8e06-8b373fc861f8.tmp]- [targetUID: 00000000-00005080] "b6263322-601b-4c0b-828c-d7302e20f810.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\b6263322-601b-4c0b-828c-d7302e20f810.tmp]- [targetUID: 00000000-00005080] "f_0004c7" has type "gzip compressed data original size modulo 2^32 184325"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c7]- [targetUID: 00000000-00008156] "fa791b51-e213-4cd2-8828-4c9835858ffb.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\fa791b51-e213-4cd2-8828-4c9835858ffb.tmp]- [targetUID: 00000000-00005080] "ad6ad250-b923-45a2-9b24-faec9b02ffe1.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ad6ad250-b923-45a2-9b24-faec9b02ffe1.tmp]- [targetUID: 00000000-00005080] "aee0e63c-50e3-43a7-8c56-3564a85d5012.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\aee0e63c-50e3-43a7-8c56-3564a85d5012.tmp]- [targetUID: 00000000-00005080] "4a090dad-f30e-4bf9-86fb-a1cd604b2853.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\4a090dad-f30e-4bf9-86fb-a1cd604b2853.tmp]- [targetUID: 00000000-00005080] "d500d9cf-6f49-4e0f-8ca7-4cac662b5b7a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\d500d9cf-6f49-4e0f-8ca7-4cac662b5b7a.tmp]- [targetUID: 00000000-00005080] "e74e6586-8010-440e-b29d-cf540df0d030.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\e74e6586-8010-440e-b29d-cf540df0d030.tmp]- [targetUID: 00000000-00005080] "f_0004c5" has type "gzip compressed data max compression original size modulo 2^32 164774"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00008156] "Network Action Predictor" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network Action Predictor]- [targetUID: 00000000-00005080] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00008156] "f_0004cb" has type "RIFF (little-endian) data Web/P image"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004cb]- [targetUID: 00000000-00008156] "f_0004ca" has type "gzip compressed data original size modulo 2^32 136857"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00008156] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00008156] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00005080] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00008156] "LICENSE" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\LICENSE]- [targetUID: 00000000-00006052] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Vpn Tokens]- [targetUID: 00000000-00005080] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00005080] "Advertising" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Advertising]- [targetUID: 00000000-00008156] "022004b5-20f2-4701-b040-6ecb40bcffac.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\022004b5-20f2-4701-b040-6ecb40bcffac.tmp]- [targetUID: 00000000-00005080] "c7633384-f31d-40c5-8a88-c191a62d2cad.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\c7633384-f31d-40c5-8a88-c191a62d2cad.tmp]- [targetUID: 00000000-00005080] "a7ee559a-21cd-4560-a69d-457972ebf95a.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\a7ee559a-21cd-4560-a69d-457972ebf95a.tmp]- [targetUID: 00000000-00005080] "37074a76-7004-485e-8356-5d04864bb290.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\37074a76-7004-485e-8356-5d04864bb290.tmp]- [targetUID: 00000000-00005080] "4b53bc8b-9b45-4831-bef0-667f1edfdaeb.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4b53bc8b-9b45-4831-bef0-667f1edfdaeb.tmp]- [targetUID: 00000000-00005080] "67f7f003-28d6-4bd7-9f88-424979e09f70.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\67f7f003-28d6-4bd7-9f88-424979e09f70.tmp]- [targetUID: 00000000-00005080] "961a166f-b2b3-4f61-aeda-5e6526887132.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\961a166f-b2b3-4f61-aeda-5e6526887132.tmp]- [targetUID: 00000000-00005080] "crl-set" has type "data"- Location: [%TEMP%\5080_376154782\crl-set]- [targetUID: 00000000-00003548] "f_0004c9" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 57849"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00008156] "f_0004c4" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 57797"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c4]- [targetUID: 00000000-00008156] "Shortcuts" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Shortcuts]- [targetUID: 00000000-00005080] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00005080] "Entities" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Entities]- [targetUID: 00000000-00008156] "f_0004c3" has type "gzip compressed data original size modulo 2^32 63801"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00008156] "WebAssistDatabase" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebAssistDatabase]- [targetUID: 00000000-00005080] "Session_13347745831232838" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13347745831232838]- [targetUID: 00000000-00005080] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00005080] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log]- [targetUID: 00000000-00005080] "Content" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Content]- [targetUID: 00000000-00008156] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00005080] "be91942e-0039-4059-a070-34880ac47c5e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\be91942e-0039-4059-a070-34880ac47c5e.tmp]- [targetUID: 00000000-00008156] "81040199-d309-40d3-9dc2-a587f6816789.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\81040199-d309-40d3-9dc2-a587f6816789.tmp]- [targetUID: 00000000-00008156] "a0e7b093-4d3f-49c4-85ee-2dd8d2f5c2ae.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a0e7b093-4d3f-49c4-85ee-2dd8d2f5c2ae.tmp]- [targetUID: 00000000-00008156] "Staging" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Staging]- [targetUID: 00000000-00008156] "edge_autofill_global_block_list.json" has type "JSON data"- Location: [%TEMP%\5080_1533544290\edge_autofill_global_block_list.json]- [targetUID: 00000000-00005080] "Analytics" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Analytics]- [targetUID: 00000000-00008156] "Social" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Social]- [targetUID: 00000000-00008156] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00005080] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Fingerprinting]- [targetUID: 00000000-00008156] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00005080] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00005080] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Cryptomining]- [targetUID: 00000000-00008156] "Advertising" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Advertising]- [targetUID: 00000000-00008156] "CompatExceptions" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\CompatExceptions]- [targetUID: 00000000-00008156] "d8312f5d5a663b17_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d8312f5d5a663b17_0]- [targetUID: 00000000-00005080] "Social" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Social]- [targetUID: 00000000-00008156] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00005080] "9df16b0eb03730e2_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9df16b0eb03730e2_0]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00005080] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG]- [targetUID: 00000000-00005080] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00005080] "dd87a896988687aa_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dd87a896988687aa_0]- [targetUID: 00000000-00005080] "aee8b470bdd6f141_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\aee8b470bdd6f141_0]- [targetUID: 00000000-00005080] "9fc73e374e216ce1_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9fc73e374e216ce1_0]- [targetUID: 00000000-00005080] "8196fa933cbd3a18_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8196fa933cbd3a18_0]- [targetUID: 00000000-00005080] "regex_patterns.json" has type "JSON data"- Location: [%TEMP%\5080_1533544290\regex_patterns.json]- [targetUID: 00000000-00005080] "Fingerprinting" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Fingerprinting]- [targetUID: 00000000-00008156] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\5080_690854535\manifest.json]- [targetUID: 00000000-00003548] "manifest.json" has type "JSON data"- Location: [%TEMP%\5080_872551854\manifest.json]- [targetUID: 00000000-00003548] "Analytics" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Analytics]- [targetUID: 00000000-00008156] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00005080] "manifest.json" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%TEMP%\5080_1533544290\manifest.json]- [targetUID: 00000000-00003548] "manifest.json" has type "JSON data"- Location: [%TEMP%\5080_376154782\manifest.json]- [targetUID: 00000000-00003548] "TransparentAdvertisers" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\TransparentAdvertisers]- [targetUID: 00000000-00006052] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00005080] "Other" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Other]- [targetUID: 00000000-00008156] "manifest.fingerprint" has type "ASCII text with no line terminators"- [targetUID: 00000000-00005080] "LICENSE" has type "ASCII text with no line terminators"- Location: [%TEMP%\5080_872551854\Sigma\LICENSE]- [targetUID: 00000000-00006052] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\5080_872551854\manifest.fingerprint]- [targetUID: 00000000-00005080] "manifest.fingerprint" has type "ASCII text with no line terminators"- Location: [%TEMP%\5080_1533544290\manifest.fingerprint]- [targetUID: 00000000-00005080] ".ses" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001]- [targetUID: 00000000-00005080] "Content" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Content]- [targetUID: 00000000-00008156] "Other" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Mu\Other]- [targetUID: 00000000-00008156] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log]- [targetUID: 00000000-00005080] "Cryptomining" has type "ASCII text"- Location: [%TEMP%\5080_872551854\Sigma\Cryptomining]- [targetUID: 00000000-00008156] "000001.dbtmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp]- [targetUID: 00000000-00005080] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00005080] "4b1fc422-280d-4eaa-82a8-5edc572e6a50.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\4b1fc422-280d-4eaa-82a8-5edc572e6a50.tmp]- [targetUID: 00000000-00005080] "3032d50b-ec87-4c45-a384-a3b4fdc7be6f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\3032d50b-ec87-4c45-a384-a3b4fdc7be6f.tmp]- [targetUID: 00000000-00005080]29:T4f5c,Pattern match: "https://atmoviesdotonline.blogspot.com/" Pattern match: "https://atmoviesdotonline.blogspot.com" Pattern match: "9.FX/QvS\b2%BfZn'R" Pattern match: "atmoviesdotonline.blogspot.com/Atmovies" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "www2.bing.comMUIDB/www.bing.comMUIDB/.msn.comUSRLOC/.microsoft.comMUID/.bing.com_RwBf/.bing.comSRCHUID/.bing.comSRCHD/.mediago.io__mguid_/.ups.comAMCV_036784BD57A8BB277F000101%40AdobeOrg/.facebook.com_js_datr/.mgid.commuidn/.ups.comups_language_preference" Pattern match: "atmoviesdotonline.blogspot.com/9https://ntp.msn.com/edge/ntp?locale=en&title=New+tab&dsp=1&sp=Bing&startpage=1&PC=U531]=https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531U-https://ntp.msn.com/edge/ntp?locale=en&title=N" Pattern match: "csp.withgoogle.com/csp/report-to/blogger-techi(%w[]httpsresources.blogblog.comblogger-techhttps://csp.withgoogle.com/csp/report-to/blogger-techY'O[]httpsatmoviesdotonline.blogspot.comblogspothttps://www.blogger.com/cspreport[]httpslogin.microsoftonline.com" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "avocet.io/aprecision.net/adpdealerservices.com/nuffnang.com.my/demdex.net/augur.io/cmmeglobal.com/adrolays.com/atrinsic.com/acuityads.com/wishabi.net/admedia.com/vertamedia.com/adworx.at/2leep.com/globe7.com/awaps.yandex.ru/i-behavior.com/reklamstore.com/m" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "https://atmoviesdotonline.blogspot.com/Atmovies" Pattern match: "https://atmoviesdotonline.blogspot.com/https://atmoviesdotonline.blogspot.com/https://atmoviesdotonline.blogspot.com/https://atmoviesdotonline.blogspot.comhttps://atmoviesdotonline.blogspot.com/https://atmoviesdotonline.blogspot.com/https://atmoviesdotonli" Pattern match: "https://ntp.msn.com/REG:https://ntp.msn.com/https://ntp.msn.com/edge/ntp.https://ntp.msn.com/edge/ntp/service-worker.js" Pattern match: "google.as/cambio.com/chrome.google.com/theboombox.com/baynote.com/aolanswers.com/tidaltv.com/disqus.com/heyzap.com/google.com.au/google.co.id/google.kg/google.co.ve/google.nr/yahoo.com/autoblog.com/feedproxy.google.com/s-msn.com/mandatory.com/noisecreep.co" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "cmail26.com/indexww.com/mkt5654.com/snapchat.com/mgid.com/zendable.com/mkt3798.com/adsafety.net/technical-service.net/hybrid.ai/contentsquare.net/mkt32.net/helpscout.net/admanmedia.com/mkt8756.com/dmxleo.com/mkt9430.com/basis.net/mailstat.us/mkt7832.com/bf" Pattern match: "autofill.account.microsoft.com/,type" Pattern match: "acxiom.com/atinternet.com/hitslink.com/mm7.net/go-mpulse.net/retailautomata.com/free-pagerank.com/amplitude.com/i-stats.com/dl-rms.com/enquisite.com/p.brsrvr.com/onestat.com/lyris.com/alexametrics.com/inboundwriter.com/awio.com/betssonpalantir.com/xiti.com" Pattern match: "emaillabs.co/open.mkt4477.com/open.mkt10008.com/open.mkt6917.com/open.mkt1946.com/convertkit-mail5.com/social-tracker.msedgedemo.example/open.mkt8062.com/open.mkt8008.com/open.mkt6316.com/m3651.net/open.mkt6793.com/open.mkt3838.com/open.mkt4158.com/eds5.ma" Pattern match: "ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.s" Pattern match: "anybest.site/webmine.pro/jsecoin.com/flightzy.bid/nerohut.com/flightsy.bid/coinpot.co/yololike.space/flightzy.win/zymerget.bid/bitcoin-pay.eu/freecontent.stream/authedwebmine.cz/zymerget.faith/hostingcloud.racing/mineralt.io/dinorslick.icu/coinhive.com/bms" Pattern match: "ufpcdn.com/vdx.tv/ebaystatic.com/ad4m.at/00px.net/warumbistdusoarm.space/ownpage.fr/smct.io/ansira.com/photorank.me/fengkongcloud.com/vtex.com.br/vocento.com/ie8eamus.com/flocktory.com/justpremium.com/dynata.com/stripst.com/adskeeper.com/curalate.com/vptms" Pattern match: "auth.adobe.com/^/horizonte.browserapps.amazon.com/^/horizonte.browserapps.amazon.de/^/horizonte.browserapps.amazon.ca/^/acrobatservices.adobe.com/^/signin.aws.amazon.com/^/horizonte-browserapps.amazon.com.br/^/zendesk.com/^/my.salesforce.com/^/disqus.com/^" Pattern match: "apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs" Pattern match: "mail.google.com/apps.fbsbx.com/fb.com/developers.google.com/friendfeed.com/social-tracker.msedgedemo.example/googlemail.com/facebook.com/plus.google.com/fbsbx.com/voice.google.com/facebook.de/facebook.fr/wave.google.com/twimg.com/orkut.com/twitter.jp/gmail" Pattern match: "apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.y0xCMa4KeeI.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8-3MGCaatZB3kdS5TpZdd-gOSBHg/cb=gapi.loaded_0?le=scs" Pattern match: "assets.db/MANIFEST-0000012023/12/22-11:10:42.830" Pattern match: "www.blogger.com/static/v1/widgets/3069997043-widgets.js" Pattern match: "www.blogger.com/static/v1/jsbin/1294958110-lbx.js" Pattern match: "apis.google.com/js/platform:gapi.iframes.style.common.js" Pattern match: "apis.google.com/js/platform.js" Pattern match: "zadn.vn/ansira.com/fcmatch.google.com/origo.hu/fcmatch.youtube.com/refersion.com/flocktory.com/vtex.com.br/rqtrk.eu/vocento.com/fingerprinter.msedgedemo.example/" Pattern match: "gimbal.com/thirdwatch.ai/fndrsp.net/analytics-tracker.msedgedemo.example/cuebiq.com/inrix.com/zoominfo.com/clarity.ms/" Pattern match: "microsoftedgeinsider.com/Fabrikam^microsoftedgeinsider.com/VanArsdel^microsoftedgeinsider.com/" Pattern match: "fcmatch.youtube.com/fcmatch.google.com/other-tracker.msedgedemo.example/" Pattern match: "http://fsf.org/" Pattern match: "http://www.gnu.org/licenses/" Pattern match: "http://www.gnu.org/philosophy/why-not-lgpl.html" Pattern match: "www.playstation.com},{applied_policy:block,domain:bing.com},{applied_policy:block,domain:browserbench.org},{applied_policy:block,domain:www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applie" Pattern match: "https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css" Pattern match: "https://atmoviesdotonline.blogspot.com/favicon.ico" Pattern match: "https://atmoviesdotonline.blogspot.com/feeds/posts/default" Pattern match: "https://atmoviesdotonline.blogspot.com/feeds/posts/default?alt=rss" Pattern match: "https://www.blogger.com/feeds/6430151528915253610/posts/default" Pattern match: "https://www.blogger.com/profile/11597854781423796273" Pattern match: "www.plyfly.net" Pattern match: "themes.googleusercontent.com/image?id=0BwVBOzw_-hbMMDYxYTU0MmQtZTA5Yi00MTIwLTk3ZjktZWI4MzJhMDQyOTIy" Pattern match: "https://resources.blogblog.com/blogblog/data/1kt/travel/bg_black_70.png" Pattern match: "https://resources.blogblog.com/blogblog/data/1kt/travel/bg_black_50.png" Pattern match: "https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6430151528915253610&zx=26f5b5d6-9b0d-4eb8-9b28-037013eba989" Pattern match: "https://apis.google.com/js/platform.js" Pattern match: "https://www.blogger.com/navbar.g?targetBlogID\x3d6430151528915253610\x26blogName\x3dAtmovies+Online\x26publishMode\x3dPUBLISH_MODE_BLOGSPOT\x26navbarType\x3dLIGHT\x26layoutType\x3dLAYOUTS\x26searchRoot\x3dhttps://atmoviesdotonline.blogspot.com/search\x26bl" Pattern match: "pagead2.googlesyndication.com/pagead/js/google_top_exp.js" Pattern match: "http://schema.org/Blog" Pattern match: "http://schema.org/BlogPosting" Pattern match: "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDn-giq2ZlM2Ok6F1gP0n39_OD9mia-0WpjSlxzGMVf39vSDCECV5OioUl-QJZ4o02EnBqgmuJg7otLCjY1ugKQJsRQKxICRanEsz1rL-sTVB8aBtv98WHFIqPEFNviXuOZo1CH41LgP681Jtln4CJOdVl8Z_3knfCAF3uomXMjU1OEQax7Htlgb0dt8M/w640-h3" Pattern match: "https://atmoviesdotonline.blogspot.com/2023/12/the-awesomeness-of-film-review-of.html" Pattern match: "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDn-giq2ZlM2Ok6F1gP0n39_OD9mia-0WpjSlxzGMVf39vSDCECV5OioUl-QJZ4o02EnBqgmuJg7otLCjY1ugKQJsRQKxICRanEsz1rL-sTVB8aBtv98WHFIqPEFNviXuOZo1CH41LgP681Jtln4CJOdVl8Z_3knfCAF3uomXMjU1OEQax7Htlgb0dt8M/s3840/o" Pattern match: "https://atmoviesdotonline.blogspot.com/2023/12/the-awesomeness-of-film-review-of.html#comment-form" Pattern match: "https://www.blogger.com/post-edit.g?blogID=6430151528915253610&postID=6979062500839766728&from=pencil" Pattern match: "https://resources.blogblog.com/img/icon18_edit_allbkg.gif" Pattern match: "https://www.blogger.com/share-post.g?blogID=6430151528915253610&postID=6979062500839766728&target=email" Pattern match: "https://atmoviesdotonline.blogspot.com/search/label/A%20Review%20of%20%5BOppenheimer%20Film%20Title%5D" Pattern match: "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg42-n9QBXPkKWkcDZMsobNkTuoiDns-2De3Bx9DzhMAetYdGHLwHrXWb9k52E02MFJ0lf2JxYUqL6DmRHZzcNFaZwNffc-5A3L8q0FtEFYn9rrUMAv17amW_b3PmxsoXhzH3gnuqdQ2_FXpmEHqMrobSnKIKt-zCcxj296DEQY4TyXjW5_71uYJ75PhD4/w640-h3" Pattern match: "https://atmoviesdotonline.blogspot.com/2023/12/barbie-film-review-complete-with-story.html" Pattern match: "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg42-n9QBXPkKWkcDZMsobNkTuoiDns-2De3Bx9DzhMAetYdGHLwHrXWb9k52E02MFJ0lf2JxYUqL6DmRHZzcNFaZwNffc-5A3L8q0FtEFYn9rrUMAv17amW_b3PmxsoXhzH3gnuqdQ2_FXpmEHqMrobSnKIKt-zCcxj296DEQY4TyXjW5_71uYJ75PhD4/s3840/B" Pattern match: "https://atmoviesdotonline.blogspot.com/2023/12/barbie-film-review-complete-with-story.html#comment-form" Pattern match: "https://www.blogger.com/post-edit.g?blogID=6430151528915253610&postID=1573763353780801685&from=pencil" Pattern match: "https://www.blogger.com/share-post.g?blogID=6430151528915253610&postID=1573763353780801685&target=email" Pattern match: "https://atmoviesdotonline.blogspot.com/search/label/Barbie%20film%20review%20Complete%20with%20story" Pattern match: "https://atmoviesdotonline.blogspot.com/search" Pattern match: "https://downloadandwatchhdfree.blogspot.com" Pattern match: "https://github.com/apps/love-lies-bleedingfree-hd" Pattern match: "https://github.com/apps/love-lies-bleeding" Pattern match: "https://github.com/apps/love-lies-bleeding-fullmovie" Pattern match: "https://github.com/apps/love-lies-bleeding-2023" Pattern match: "https://github.com/apps/watch-love-lies-bleeding" Pattern match: "https://github.com/apps/love-lies-bleeding-deutsch" Pattern match: "https://github.com/apps/love-lies-bleeding-ansehen-film" Pattern match: "https://github.com/apps/love-lies-bleeding-film-jetzt" Pattern match: "https://github.com/apps/love-lies-bleeding-ganzer-online" Pattern match: "https://www.blogger.com/go/report-abuse" Pattern match: "https://atmoviesdotonline.blogspot.com/2023/12/" Pattern match: "https://www.blogger.com" Pattern match: "https://www.blogger.com/static/v1/widgets/3069997043-widgets.js" Pattern match: "www.blogger.com/rearrange?blogID\x3d6430151528915253610','//atmoviesdotonline.blogspot.com/','6430151528915253610" Pattern match: "https://www.blogger.com/static/v1/jsbin/1294958110-lbx.js" Pattern match: "yandex.ru/clck/click" Pattern match: "yandex.ru/clck/counter" Pattern match: "yandex.ru/portal/set/any" Pattern match: "yandex.ru/set/s/rsya-tag-users/data" Pattern match: "yandex.ru/cycounter" Heuristic match: "httpool.com/" Heuristic match: "connatix.com^Connatix.com" Heuristic match: "2leep.com^2leep.com" Heuristic match: "amazon-adsystem.com^Amazon.com" Heuristic match: "tracemyip.org^TraceMyIP.org" Heuristic match: "amazon.com.mx^Amazon.com" Heuristic match: "amazoninspire.com^Amazon.com" Heuristic match: "boxofficemojo.com^Amazon.com" Heuristic match: "amazon.co.uk^Amazon.com" Heuristic match: "amazon.es^Amazon.com" Heuristic match: "amazon.fr^Amazon.com" Heuristic match: "adversal.com^Adversal.com" Heuristic match: "brilliancepublishing.com^Amazon.com" Heuristic match: "6pm.com^Amazon.com" Heuristic match: "twitch.tv^Amazon.com" Heuristic match: "abebooks.fr^Amazon.com" Heuristic match: "amazon.com^Amazon.com" Heuristic match: "alexa.com^Amazon.com" Heuristic match: "audible.fr^Amazon.com" Heuristic match: "adf.ly^AdF.ly" Heuristic match: "createspace.com^Amazon.com" Heuristic match: "dpreview.com^Amazon.com" Pattern match: "www.unanimis.co.uk^Unanimis" Heuristic match: "souq.com^Amazon.com" Heuristic match: "yoyo.com^Amazon.com" Heuristic match: "zvab.com^Amazon.com" Pattern match: "www.eyeconomy.co.uk^Eyeconomy" Heuristic match: "pillpack.com^Amazon.com" Heuristic match: "advertise.com^Advertise.com" Heuristic match: "wholefoodsmarket.com^Amazon.com" Heuristic match: "audible.co.uk^Amazon.com" Heuristic match: "ssl-images-amazon.com^Amazon.com" Heuristic match: "adv-adserver.com^Adversal.com" Heuristic match: "imdb.com^Amazon.com" Heuristic match: "autocentre.ua^AUTOCENTRE.UA" Heuristic match: "amazon.co.jp^Amazon.com" Heuristic match: "abebooks.co.uk^Amazon.com" Pattern match: "www.geniegroupltd.co.uk^GENIE" Heuristic match: "force.com^Salesforce.com" Heuristic match: "abebooks.com^Amazon.com" Heuristic match: "amazon.cn^Amazon.com" Pattern match: "www.caraytech.com.ar^Caraytech" Heuristic match: "look.com^Amazon.com" Heuristic match: "blogcounter.de^BlogCounter.com" Heuristic match: "goodreads.com^Amazon.com" Heuristic match: "acx.com^Amazon.com" Heuristic match: "browser-update.org^Browser-Update.org" Heuristic match: "cloudfront.net^Amazon.com" Heuristic match: "nugg.ad^nugg.ad" Heuristic match: "assoc-amazon.com^Amazon.com" Heuristic match: "imdb.de^Amazon.com" Heuristic match: "statistics.ro^Cart.ro" Heuristic match: "brand.net^Brand.net" Heuristic match: "amazonaws.com^Amazon.com" Pattern match: "www.nuffnang.com.my^Nuffnang" Heuristic match: "fabric.com^Amazon.com" Heuristic match: "audible.com^Amazon.com" Heuristic match: "lzjl.com^Paypopup.com" Heuristic match: "paypopup.com^Paypopup.com" Heuristic match: "adtegrity.net^Adtegrity.com" Heuristic match: "woot.com^Amazon.com" Heuristic match: "mypagerank.net^MyPagerank.Net" Heuristic match: "iberlibro.com^Amazon.com" Heuristic match: "amazon.com.br^Amazon.com" Heuristic match: "amazon.com.au^Amazon.com" Heuristic match: "amazon.com.tr^Amazon.com" Heuristic match: "amazon.nl^Amazon.com" Heuristic match: "hurra.com^Hurra.com" Heuristic match: "amazon.sa^Amazon.com" Heuristic match: "free-pagerank.com^Free-PageRank.com" Heuristic match: "lightning.com^Salesforce.com" Heuristic match: "eastdane.com^Amazon.com" Heuristic match: "audible.de^Amazon.com" Heuristic match: "alexametrics.com^Amazon.com" Heuristic match: "comixology.com^Amazon.com" Heuristic match: "amazon.in^Amazon.com" Heuristic match: "ismatlab.com^ismatlab.com" Heuristic match: "forcesslreports.com^Salesforce.com" Heuristic match: "twitch.com^Amazon.com" Heuristic match: "withoutabox.com^Amazon.com" Heuristic match: "nuggad.net^nugg.ad" Heuristic match: "oversee.net^Oversee.net" Heuristic match: "web.com^Web.com" Heuristic match: "match.com^Match.com" Heuristic match: "am.ua^AUTOCENTRE.UA" Heuristic match: "mail.ru^Mail.Ru" Pattern match: "www.grapeshot.co.uk^Grapeshot" Pattern match: "www.hands.com.br^Hands" Heuristic match: "simpli.fi^Simpli.fi" Heuristic match: "amung.us^whos.amung.us" Heuristic match: "audible.in^Amazon.com" Heuristic match: "adnetwork.net^AdNetwork.net" Heuristic match: "amazon.com.sg^Amazon.com" Heuristic match: "layer-ad.org^Layer-Ad.org" Heuristic match: "chemistry.com^Match.com" Heuristic match: "list.ru^Mail.Ru" Heuristic match: "amazon.it^Amazon.com" Heuristic match: "salesforce-communities.com^Salesforce.com" Heuristic match: "popunder.ru^Popunder.ru" Heuristic match: "affbuzzads.com^MovieLush.com" Heuristic match: "audible.it^Amazon.com" Pattern match: "www.terra.com.br^Terra" Heuristic match: "shopbop.com^Amazon.com" Heuristic match: "i.ua^I.UA" Pattern match: "www.adlantis.jp^AdLantis" Pattern match: "www.platform-one.co.jp^PLATFORM" Heuristic match: "parsely.com^Parse.ly" Heuristic match: "persianstat.com^PersianStat.com" Heuristic match: "extensions.ru^EXTENSIONS.RU" Heuristic match: "po.st^Po.st" Heuristic match: "primawebtools.de^anormal-media.de" Pattern match: "www.opt.ne.jp^OPT" Heuristic match: "webgozar.com^WebGozar.com" Heuristic match: "cart.ro^Cart.ro" Heuristic match: "tongdun.cn^tongdun.cn" Heuristic match: "visualforce.com^Salesforce.com" Heuristic match: "zappos.com^Amazon.com" Heuristic match: "amazon.de^Amazon.com" Heuristic match: "documentforce.com^Salesforce.com" Heuristic match: "forceusercontent.com^Salesforce.com" Heuristic match: "salesforce.com^Salesforce.com" Heuristic match: "trailblazer.me^Salesforce.com" Heuristic match: "salesforce-hub.com^Salesforce.com" Heuristic match: "adtegrity.com^Adtegrity.com" Heuristic match: "salesforceliveagent.com^Salesforce.com" Pattern match: "www.trovus.co.uk^Trovus" Heuristic match: "webgozar.ir^WebGozar.com" Heuristic match: "dpreview.in^Amazon.com" Heuristic match: "feedperfect.com^Web.com" Heuristic match: "sputnik.ru^Sputnik.ru" Pattern match: "www.webads.co.uk^WebAds" Heuristic match: "tongdun.net^tongdun.cn" Pattern match: "www.summit.co.uk^Summit" Heuristic match: "amazon.ca^Amazon.com" Heuristic match: "rsvpgenius.com^Genius.com" Heuristic match: "eproof.com^eProof.com" Heuristic match: "fraudmetrix.cn^tongdun.cn" Heuristic match: "dsply.com^Answers.com" Heuristic match: "tap.me^Tap.me" Heuristic match: "genius.com^Genius.com" Heuristic match: "amazon.ae^Amazon.com" Heuristic match: "dwstat.cn^dwstat.com" Heuristic match: "adsrevenue.net^Adsrevenue.net" Heuristic match: "segment.io^Segment.io" Heuristic match: "paid-to-promote.net^Paid-To-Promote.net" Pattern match: "www.fxj.com.au^Fairfax" Heuristic match: "pixel.sg^Pixel.sg" Heuristic match: "media.net^media.net" Heuristic match: "abebooks.de^Amazon.com" Heuristic match: "meetic-partners.com^Match.com" Heuristic match: "dsnextgen.com^Oversee.net" Heuristic match: "bookdepository.com^Amazon.com" Heuristic match: "anormal-tracker.de^anormal-media.de" Heuristic match: "junglee.com^Amazon.com" Heuristic match: "anormal-media.de^anormal-media.de" Pattern match: "www.microad.jp^MicroAd" Heuristic match: "atoomic.com^Atoomic.com" Heuristic match: "abebooks.it^Amazon.com" Heuristic match: "adbroker.de^Adbroker.de" Heuristic match: "movielush.com^MovieLush.com" Heuristic match: "answers.com^Answers.com" Heuristic match: "audible.co.jp^Amazon.com" Heuristic match: "teads.tv^Teads.tv" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Heuristic match: "apis.google.com" Heuristic match: "atmoviesdotonline.blogspot.com" Heuristic match: "blogger.googleusercontent.com" Heuristic match: "pagead2.googlesyndication.com" Heuristic match: "resources.blogblog.com" Heuristic match: "themes.googleusercontent.com" Pattern match: "www.blogger.com"2a:T104f,"_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '6430151528915253610', 'title': 'Atmovies Online', 'url': 'https://atmoviesdotonline.blogspot.com/', 'canonicalUrl': 'https://atmoviesdotonline.blogspot.com/', 'homepageUrl': 'https://atmoviesdotonline.blogspot.com/', 'searchUrl': 'https://atmoviesdotonline.blogspot.com/search', 'canonicalHomepageUrl': 'https://atmoviesdotonline.blogspot.com/', 'blogspotFaviconUrl': 'https://atmoviesdotonline.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Atmovies Online - Atom\x22 href\x3d\x22https://atmoviesdotonline.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Atmovies Online - RSS\x22 href\x3d\x22https://atmoviesdotonline.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Atmovies Online - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/6430151528915253610/posts/default\x22 /\x3e\n', 'meTag': '\x3clink rel\x3d\x22me\x22 href\x3d\x22https://www.blogger.com/profile/11597854781423796273\x22 /\x3e\n', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/1a807f1b871b67af', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'index', 'pageName': '', 'pageTitle': 'Atmovies Online', 'metaDescription': ''}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'Travel', 'localizedName': 'Travel', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': false, 'variant': 'road', 'variantId': 'road'}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Atmovies Online', 'description': '', 'url': 'https://atmoviesdotonline.blogspot.com/', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': true, 'isArchive': false, 'isLabelSearch': false}}]);"2b:T558,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADyElEQVR4Xu2XyU8TYRjG/Ytc4nZ1uXj3ZjRu0YtGr3rQsK+FIiFAWwptoRVrXYILIjaoBMtRrQeNihxEISWyd2F7nOdrv+l0Njt6dZInnQYyv9/7zve9M92x4/9hcoTDYTADAwPo7+9HKBRCMBhCIBhEIBBAX18fent74ff3osfvh6+nB16fD16vDx6PF37lbx0dHdBft+yD8K2tLUM2tdnUZxPb29uIRCKYnp4WUn8twcoJ3NjYwDqzLrOOnEwu/5nNyeSEBAWWl5fx9esUPF4v3H8jwbabCahwntsILCwsYH5+Hh8/fUJXtwdut9uZBO85BQTcTIBwFWwUSKVSmJubw8zMDJLJJDo7u5wJcMGpAlbt14D1Ai6XqyRt7e3OBLjahYAKt2l/tijA81ml8p+zMrNKN+bRduuWQwFlq0mBIlgDN2m/FMhok8kq62gT7jaHAtzn3Gp/hOuqLxXIqgKt7jZnAhwyeQF2oAguXfkauFn1ikC6INDS6nAXcMJxuJiD+V3C7auXAq7WVmcCHK+iAzpwadut4MXqpUBzS4szAY5RdsAAVuHFtpvBZfWqgMuhAB8s3NMqRCviAC4FmppdDgW8FNB2oAC1hecM8LzABhqbmp0J8JGqdkAHNQWbVC7DadrQ1ORMoNvjyQtooOZge3g6nREC9Y02AolEApOTk0i8eYOJiQmMj4/j9avXePXyJcbGxhCPx/Fi9AVGnz/HyLMRjCif5cLXCgJ1DY3WAoTzPpWbp0+eqOA/wVWB+gZrAVbOC2cyGXz4MoujV6M4eDFsSDqdFv/3+NEja7AOLgVq6+qtBdh2KcAkv/zEkSuDOHAhVBIK8JE8NDRkhBaiBWsFaurqrAV4z/UChy+Hsf98oCRra2tC4OGDhwawvmq9QHWtjQAXnBRIfv6BQ5f6se+cvzRn/VhdXRXPgAf375cF1gpU1dRaC3C1S4HzDUPYe9ZnzBkfVlZWhMC9WKwssFagsrrGWoBbjQKpX0vYc9pTSLdILP5ehOd8080qqz8WjRogdhECVdXWAtznFJj6nsLuU11qYvF3ou2sPDr6FktLS0IgOnjHALELBSrsBDhk5C04djWIXSc7cPxaRIWzcsIXFxeFwGDkdvFtuczcrKyyFuCEowAvPvFuCjtPtON01V2x6rUSDCUjyq8mznaOV044Dhnuc241rnYuON5ztp2VE36jotJagONVTjlus8T7b7jeOZx/61GkZOQ2HVB+tOiv8U/H8PCwGK+ccBwy3OfcalztXHC852w7Kyc8oLwv6q/xL8dv681F4q47L9QAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 99ba7bfdc811… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 99ba7bfdc811…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"https://atmoviesdotonline.blogspot.com/\",\"applicationCategory\":[\"url\"],\"identifier\":\"99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790526174590,"unified_at":"2026-09-27T16:22:54.590Z","metadata":{"hashes":{"sha256":"99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f","sha1":"53e234f28f0c3c32e4f2f0fd5b9c04986ae556fd","md5":"a109f835ec0267f9e2fbd1574d34127f","sha512":"645dac18e1a26e642680caa80e45cc00a5e344a43163a030b22b5e3ad3202698b8cd8dee28d54af2268c28813c580b927769718469866695591088e54e534e35","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://atmoviesdotonline.blogspot.com/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1703272068000,"last_seen":1703272068000,"last_multi_scan":1703272068000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":8,"suspicious_count":1,"malicious_count":0,"total":9},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"172.217.164.97:443\"\n \"142.251.46.238:443\"\n \"142.250.191.41:443\"\n \"142.251.46.161:443\"\n \"142.250.191.66:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:6152:120:WilError_01\"\n \"Local\\SM0:6152:304:WilStaging_02\"\n \"Local\\SM0:6152:120:WilError_01\"\n \"SM0:6152:304:WilStaging_02\"\n \"InternetShortcutMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$26","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"apis.google.com\"\n \"atmoviesdotonline.blogspot.com\"\n \"blogger.googleusercontent.com\"\n \"pagead2.googlesyndication.com\"\n \"resources.blogblog.com\"\n \"themes.googleusercontent.com\"\n \"www.blogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"silverpop.com/\" [Source: Advertising]\n Observed email domain:\"silverpop.com^silverpop\" [Source: Entities]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":149,"dropped_files_count":0,"extracted_files_count":44,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":7,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"6585de84e0be28eb0a0532c8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f.url","analysis_start_time":"2023-12-22T19:07:48+00:00","indicators_count":{"informative":8,"suspicious":1,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.217.164.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"address":"142.251.46.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"address":"142.250.191.41","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"address":"142.251.46.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"address":"142.250.191.66","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"dns_resolutions":[{"domain":"apis.google.com","address":"142.251.46.238","ttl":213,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"atmoviesdotonline.blogspot.com","address":"172.217.164.97","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2000-07-31T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"blogger.googleusercontent.com","address":"142.251.46.161","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-11-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"pagead2.googlesyndication.com","address":"142.250.191.66","ttl":83,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2003-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"resources.blogblog.com","address":"142.250.191.41","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2000-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"themes.googleusercontent.com","address":"142.251.46.161","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-11-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"domain":"www.blogger.com","address":"142.250.191.41","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1999-06-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}],"processes":[{"pid":6152,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\system32\\ieframe.dll\",OpenURL C:\\sample.url","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\system32\\rundll32.exe","uid":"00000000-00006152","icon":"$2b"},{"pid":5080,"ppid":6152,"name":"msedge.exe","command_line":"--single-argument https://atmoviesdotonline.blogspot.com/","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006152","uid":"00000000-00005080"},{"pid":8180,"ppid":5080,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd8,0x7ffa86c6b208,0x7ffa86c6b218,0x7ffa86c6b228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00008180"},{"pid":8112,"ppid":5080,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00008112"},{"pid":8156,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00008156"},{"pid":748,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00000748"},{"pid":6548,"ppid":5080,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1703271169202783 --launch-time-ticks=1060873570 --mojo-platform-channel-handle=3248 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00006548"},{"pid":7344,"ppid":5080,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1703271169202783 --launch-time-ticks=1061384134 --mojo-platform-channel-handle=3268 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00007344"},{"pid":7360,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00007360"},{"pid":1092,"ppid":5080,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1703271169202783 --launch-time-ticks=1068022026 --mojo-platform-channel-handle=5032 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00001092"},{"pid":1608,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4368 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00001608"},{"pid":2296,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5220 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00002296"},{"pid":3060,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4368 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00003060"},{"pid":2500,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5440 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00002500"},{"pid":4204,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5452 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00004204"},{"pid":3548,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1136 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00003548"},{"pid":4176,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00004176"},{"pid":6616,"ppid":5080,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00006616"},{"pid":5620,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5808 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00005620"},{"pid":6052,"ppid":5080,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5304 --field-trial-handle=2052,i,4591814099554363095,13130467681109715282,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005080","uid":"00000000-00006052"}],"all_imported_dlls":["ucrtbase.dll","gdi32.dll","dhcpcsvc6.dll","npmproxy.dll","WinTypes.dll","d3d11.dll","edputil.dll","msedge_elf.dll","msedge.dll","wldp.dll","mfsensorgroup.dll","sspicli.dll","ole32.dll","clbcatq.dll","shlwapi.dll","dmcmnutils.dll","d3dcompiler_47.dll","KBDUS.DLL","dpapi.dll","Windows.Security.Authentication.Web.Core.dll","propsys.dll","fltLib.dll","combase.dll","TextInputFramework.dll","dcomp.dll","Windows.System.Profile.RetailInfo.dll","D3D12.dll","secur32.dll","nlaapi.dll","twinapi.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","tbs.dll","BitsProxy.dll","profapi.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","iertutil.dll","PCPKsp.dll","CompPkgSup.dll","DolbyDecMFT.dll","msvcrt.dll","rasadhlp.dll","version.dll","winmm.dll","FWPUCLNT.DLL","SHCore.dll","windows.storage.dll","libEGL.dll","dxilconv.dll","twinapi.appcore.dll","OneCoreUAPCommonProxyStub.dll","Windows.Web.dll","telclient.dll","Windows.Networking.Connectivity.dll","vk_swiftshader.dll","gdi32full.dll","powrprof.dll","dbghelp.dll","dhcpcsvc.dll","wintrust.dll","microsoft_apis.dll","CoreUIComponents.dll","mscms.dll","nsi.dll","cryptsp.dll","wevtapi.dll","ntdll.dll","CoreMessaging.dll","mfplat.dll","mswsock.dll","onramp.dll","ntmarta.dll","actxprxy.dll","wlanapi.dll","msmpeg2vdec.dll","libGLESv2.dll","msctf.dll","Windows.Media.dll","RTWorkQ.dll","vaultcli.dll","fwbase.dll","dxva2.dll","winhttp.dll","msvcp110_win.dll","cldapi.dll","dnsapi.dll","rmclient.dll","wkscli.dll","ntasn1.dll","winsta.dll","rsaenh.dll","fwpolicyiomgr.dll","ffmpeg.dll","ncrypt.dll","linkinfo.dll","oneds.dll","Windows.Security.Authentication.OnlineId.dll","kernel32.dll","oleaut32.dll","wtsapi32.dll","cryptnet.dll","imm32.dll","IPHLPAPI.DLL","netprofm.dll","netapi32.dll","msvproc.dll","kernel.appcore.dll","dsreg.dll","FirewallAPI.dll","advapi32.dll","OneCoreCommonProxyStub.dll","DataExchange.dll","dxgi.dll","aepic.dll","mf.dll","cryptbase.dll","user32.dll","cfgmgr32.dll","gpapi.dll","win32u.dll","winmmbase.dll","netutils.dll","mdmregistration.dll","oleacc.dll","msvcp_win.dll","shell32.dll","msasn1.dll","directmanipulation.dll","srumapi.dll","comctl32.dll","Windows.UI.dll","setupapi.dll","rpcrt4.dll","userenv.dll","crypt32.dll","devobj.dll","KernelBase.dll","sechost.dll","bcryptprimitives.dll","uxtheme.dll","ws2_32.dll","atlthunk.dll","ResourcePolicyClient.dll","mfperfhelper.dll","dwmapi.dll","bcrypt.dll","UIAutomationCore.dll","DWrite.dll","vulkan-1.dll","d3d10warp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3032d50b-ec87-4c45-a384-a3b4fdc7be6f.tmp","sha256":"76bb899180cd47b2d938ecf90322220af05bb32c878566180ff2b61d85505dcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"LOG","sha256":"57397b0a26eb8ef6e7e0e3d5a8154eca7d77001cd3c21d4ae77e027ce38db4cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"4a090dad-f30e-4bf9-86fb-a1cd604b2853.tmp","sha256":"81972627c1674268691473816dc6affa3338936ea918fcd053b94a8fc145f6a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"5c3446b4-066b-4e55-bf9c-71951adbd1ab.tmp","sha256":"bd2d34628ed1269caa8d680080f93161309898519c43e77b4ae817fbbef103d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"6565f919-bfa4-467d-9db1-90e40b3e06f3.tmp","sha256":"f0a292947ee2bf8c6c1d97de622e9aa51d71487a4be6e2e78ff5ade37f05d100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"settings.dat","sha256":"ff788ad9260235970674c12b2c4faa4c1825b6cbe3b471b8de23ef1ae13b1a56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"022004b5-20f2-4701-b040-6ecb40bcffac.tmp","sha256":"cf70fa4f1f7878b6566fcebe56beffe53f13b6f5fbe8ec62635c033e66d63ebd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"37074a76-7004-485e-8356-5d04864bb290.tmp","sha256":"b630937101eef5c8cf9d597f29fc3a860190d0a96b4364ac8dd32309479b6f26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"4b1fc422-280d-4eaa-82a8-5edc572e6a50.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"4b53bc8b-9b45-4831-bef0-667f1edfdaeb.tmp","sha256":"7bbcb704c9e0b1eea97366dc7ef4180a16b642992213e8070c56ea4e021c0804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"67f7f003-28d6-4bd7-9f88-424979e09f70.tmp","sha256":"1ac87637644bd73f785f84c795c26172255e251f693113cd9ae4d5789794ea3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"961a166f-b2b3-4f61-aeda-5e6526887132.tmp","sha256":"cb01c1e294d469053a5c38c760d442d8a75232b2b4e0950c24231da72eb564d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"000001.dbtmp","sha256":"0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"000003.log","sha256":"68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"MANIFEST-000001","sha256":"f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"data_0","sha256":"3831902128f1deade87d4bad14ba8ab4dbcc6c7d4e1495304b4ba0cb5cb0bcac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"data_1","sha256":"67e8b705835c4ed6717cfe30c008cf705d33aeee29028100d07d7fd978fda3f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"data_2","sha256":"1375c25c2e0f0bdb495e47868acc2fb0be397f6c78b50de94070f4bd79c6662a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"data_3","sha256":"7ff544954cbd8d138ecdd581ffeb8e89782bb2da76b171af0bd51ce11d6e8f66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c3","sha256":"e29dd22b8f0d281bf36f11a260d707b08b05f8d2c6d9bdfd9d12c3626cafb371","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c4","sha256":"74bece3266374f5aa3043309d94a5cbd2ea847be1a5bc57460693c165a5a0b09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c5","sha256":"44af1fff76b29b2a443e8ec9b1e1d83778c0af8c2b8f1cb37fdb7f109da528d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c6","sha256":"055587922cbf48e299ac082ddad1b9739c8d747ac34c76c90ff7abb0b0a57c00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c7","sha256":"e81c9b5af64152c02514790ed08b9d938b1696055ab8aea61511663c0b845419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c8","sha256":"143372db7f1104764fc62bd8f7dc5fa44a45fb472b88608d2b9ea3ebe9703f8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004c9","sha256":"fcb8519790d421a18975bf063f66881b7a728b39124ad3cc1f62cf1b6216b937","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004ca","sha256":"5a5a77f2321c2400046e66dc560304bf4187a2368f62aaa84ef9cdf21d7b726a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004cb","sha256":"9cd03490043262d20ede42b6beeca5d1215a7c07b6e09c6c9a9a2ccd42795bde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"f_0004cc","sha256":"ea3c28671b0b18580ea11bcbfccf68bcff6fa6e228652a87facd2e117423a03f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"8196fa933cbd3a18_0","sha256":"88a631e6d3ee63e245180443bfc231044da9a99afac21df84cf260a233239354","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"9df16b0eb03730e2_0","sha256":"7832226533de1375053bb4c63f89b901d1c2a3670ea7aaa72de9f8c8569fa639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"9fc73e374e216ce1_0","sha256":"3791191a614aa272f3a45ca27a64fbaa3b9db47d92f40286b9ab4ed3156c92cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"aee8b470bdd6f141_0","sha256":"e5ef6156052f4668d005674a7d06f602a4392e0e2c8bb098cb36e03740821b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"d8312f5d5a663b17_0","sha256":"f921189a10b388ebdb7ad2a40a3d0964d4c17604aa5dfc37a30a72797b1f13e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"dd87a896988687aa_0","sha256":"387bf644a55ad00a8bd37df3a3536b3cdae4a925ab1e8f773dad933199acf064","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"temp-index","sha256":"519325b05a2c8c029e93a35599fd966dd468f91851600eec612c34b271f928a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Favicons","sha256":"3ae3ea53bdf1c3018701932eb1d19142a7b2c2d470aab3a190ee2ad6e5961da9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"History","sha256":"b5ee3264fbd23b307a7006ef996eb73789ed1bc66b6f90aba1cab697611ffcdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Network Action Predictor","sha256":"06439918e9a7c16bc8cb8d66dcaa32ef80f3d58e2fa4823d43bab19be0edc329","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"81040199-d309-40d3-9dc2-a587f6816789.tmp","sha256":"6aab243352cfd02f20cb58ad3025f7fb94e661344bbc9c61eae47fdffa5b144e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Cookies","sha256":"76c57e128771b3c7a9f3262269a2d689f2a8d39239d6e8c38c295d3b6579a7ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Reporting and NEL","sha256":"01f26cb2410109ad85918e6e247fa78109bb2c4618040d958c508daed4893db2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"a0e7b093-4d3f-49c4-85ee-2dd8d2f5c2ae.tmp","sha256":"b6839fbd8a0a7080173c69cd0987fb42613b494aef5e2b940bb7a854e216997c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"urlref_httpsatmoviesdotonline.blogspot.com","sha256":"72d041cd99d9261741d344e74a96050e5625972a867887b8d889d14710484d43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Variations","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\BrowserMetrics-6585DF23-13D8.pma","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\index","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\000004.log","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\LOG","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5e4a230e-fc0c-4d38-9337-1fb9305a0453.tmp","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\36d5fefc-8923-4742-88c9-61c81915b7d1.tmp","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_376154782\\crl-set","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_376154782\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_1533544290\\edge_autofill_field_data.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_1533544290\\edge_autofill_global_block_list.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_1533544290\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_1533544290\\regex_patterns.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_1533544290\\v1FieldTypes.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_690854535\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_690854535\\recovery-component-inner.crx","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Advertising","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Analytics","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\CompatExceptions","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Content","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Cryptomining","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Entities","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Fingerprinting","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Other","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\Social","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Mu\\TransparentAdvertisers","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Advertising","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Analytics","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Content","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Cryptomining","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Entities","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Fingerprinting","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Other","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Social","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"path":"%TEMP%\\5080_872551854\\Sigma\\Staging","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\MICROSOFTEDGEAUTOLAUNCH_4215C1C5D37EBD5E76A2BF3CC4851FE2\\MICROSOFTEDGEAUTOLAUNCH_4215C1C5D37EBD5E76A2BF3CC4851FE2","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:6152:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Local\\SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"Local\\SM0:6152:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"SM0:6152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]},{"name":"InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"6585de84e0be28eb0a0532c8"}]}]}},"report_ids":{"sandbox_job_ids":["6585de84e0be28eb0a0532c8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 99ba7bfdc811… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 99ba7bfdc811…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f"}],["$","meta","4",{"property":"og:title","content":"Sample 99ba7bfdc811… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 99ba7bfdc811…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/99ba7bfdc81141f09b4e014ee1e1b843a7d242e25f3e745488d61c291a0a6e0f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 99ba7bfdc811… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 99ba7bfdc811…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]