Malware Analysis Report

2024-08-06 11:58

Sample ID 231001-xtcwvace8t
Target Sclix.exe
SHA256 2b2a1cec02d3ceff888429ebd5f4bf95cef7e2a5b09227b54d8f8cbe2b061ecf
Tags
toxiceye rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2b2a1cec02d3ceff888429ebd5f4bf95cef7e2a5b09227b54d8f8cbe2b061ecf

Threat Level: Known bad

The file Sclix.exe was found to be: Known bad.

Malicious Activity Summary

toxiceye rat spyware stealer trojan

Toxiceye family

ToxicEye

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Delays execution with timeout.exe

Enumerates processes with tasklist

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Process Discovery
T1057
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-10-01 19:08

Signatures

Toxiceye family

toxiceye

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-01 19:08

Reported

2023-10-01 19:11

Platform

win10v2004-20230915-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Sclix.exe"

Signatures

ToxicEye

rat trojan toxiceye

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Sclix.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\ToxicEye\rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Sclix.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Users\ToxicEye\rat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\ToxicEye\rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1908 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Sclix.exe C:\Windows\System32\schtasks.exe
PID 1908 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Sclix.exe C:\Windows\System32\schtasks.exe
PID 1908 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\Sclix.exe C:\Windows\System32\cmd.exe
PID 1908 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\Sclix.exe C:\Windows\System32\cmd.exe
PID 1604 wrote to memory of 1648 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1604 wrote to memory of 1648 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1604 wrote to memory of 5000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1604 wrote to memory of 5000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\find.exe
PID 1604 wrote to memory of 3568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1604 wrote to memory of 3568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\timeout.exe
PID 1604 wrote to memory of 4912 N/A C:\Windows\System32\cmd.exe C:\Users\ToxicEye\rat.exe
PID 1604 wrote to memory of 4912 N/A C:\Windows\System32\cmd.exe C:\Users\ToxicEye\rat.exe
PID 4912 wrote to memory of 1668 N/A C:\Users\ToxicEye\rat.exe C:\Windows\System32\schtasks.exe
PID 4912 wrote to memory of 1668 N/A C:\Users\ToxicEye\rat.exe C:\Windows\System32\schtasks.exe
PID 4912 wrote to memory of 1448 N/A C:\Users\ToxicEye\rat.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4912 wrote to memory of 1448 N/A C:\Users\ToxicEye\rat.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 3004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 4104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Sclix.exe

"C:\Users\Admin\AppData\Local\Temp\Sclix.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp788B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp788B.tmp.bat

C:\Windows\system32\tasklist.exe

Tasklist /fi "PID eq 1908"

C:\Windows\system32\find.exe

find ":"

C:\Windows\system32\timeout.exe

Timeout /T 1 /Nobreak

C:\Users\ToxicEye\rat.exe

"rat.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://buy.stripe.com/5kAfZD1TD4IP1tS4gg

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd33946f8,0x7fffd3394708,0x7fffd3394718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3128701430453073519,17431321725288422633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 254.1.248.8.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 buy.stripe.com udp
US 54.163.195.10:443 buy.stripe.com tcp
US 8.8.8.8:53 checkout.stripe.com udp
US 151.101.0.176:443 checkout.stripe.com tcp
US 8.8.8.8:53 js.stripe.com udp
US 8.8.8.8:53 r.stripe.com udp
US 8.8.8.8:53 api.stripe.com udp
US 8.8.8.8:53 10.195.163.54.in-addr.arpa udp
US 8.8.8.8:53 176.0.101.151.in-addr.arpa udp
US 54.187.159.182:443 r.stripe.com tcp
US 34.204.109.15:443 api.stripe.com tcp
NL 13.227.219.27:443 js.stripe.com tcp
NL 13.227.219.27:443 js.stripe.com tcp
NL 13.227.219.27:443 js.stripe.com tcp
NL 13.227.219.27:443 js.stripe.com tcp
NL 13.227.219.27:443 js.stripe.com tcp
US 8.8.8.8:53 checkout-cookies.stripe.com udp
US 8.8.8.8:53 merchant-ui-api.stripe.com udp
US 198.137.150.81:443 checkout-cookies.stripe.com tcp
US 198.137.150.141:443 merchant-ui-api.stripe.com tcp
US 8.8.8.8:53 15.109.204.34.in-addr.arpa udp
US 8.8.8.8:53 141.150.137.198.in-addr.arpa udp
US 8.8.8.8:53 81.150.137.198.in-addr.arpa udp
US 8.8.8.8:53 182.159.187.54.in-addr.arpa udp
US 8.8.8.8:53 27.219.227.13.in-addr.arpa udp
US 8.8.8.8:53 b.stripecdn.com udp
US 8.8.8.8:53 hcaptcha.com udp
US 104.16.168.131:443 hcaptcha.com tcp
US 8.8.8.8:53 131.168.16.104.in-addr.arpa udp
US 8.8.8.8:53 stripe-camo.global.ssl.fastly.net udp
US 151.101.1.194:443 stripe-camo.global.ssl.fastly.net tcp
US 8.8.8.8:53 194.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 m.stripe.network udp
US 18.239.94.73:443 m.stripe.network tcp
US 8.8.8.8:53 73.94.239.18.in-addr.arpa udp
US 8.8.8.8:53 m.stripe.com udp
US 52.10.94.213:443 m.stripe.com tcp
US 8.8.8.8:53 213.94.10.52.in-addr.arpa udp
US 8.8.8.8:53 234.17.178.52.in-addr.arpa udp

Files

memory/1908-0-0x0000020CDE8C0000-0x0000020CDE900000-memory.dmp

memory/1908-1-0x00007FFFD8950000-0x00007FFFD9411000-memory.dmp

memory/1908-2-0x0000020CF8EC0000-0x0000020CF8ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp788B.tmp.bat

MD5 6f120c6ca26ee4c57d2c12920b47d299
SHA1 c73e234644b28c6b84fd2030fb3024681f2fa285
SHA256 2f7d275f04d580605731dddcd45ab1e5195878a808bceca7664f63fea84a27a8
SHA512 a234896719a78ff8ce34f2fdad4d89b31f08837ed6a651315c0c0423bc7ccc34d42488dac72762870591f339461e67ee128910833b9a60d3c46e822eaba79202

memory/1908-7-0x00007FFFD8950000-0x00007FFFD9411000-memory.dmp

C:\Users\ToxicEye\rat.exe

MD5 c7f1bd7b57edf9520890ee16983502fa
SHA1 fdbc603b4db1c31a9ce8a2fd7a9762058f70bd6e
SHA256 2b2a1cec02d3ceff888429ebd5f4bf95cef7e2a5b09227b54d8f8cbe2b061ecf
SHA512 69f867868238cb297d13f3a40a01d0898de76db3286bc21d745e55f6bde237469d96654f3da1618183250ca991061d041ae75ca9e5e63a2247cbb13286cb78ee

C:\Users\ToxicEye\rat.exe

MD5 c7f1bd7b57edf9520890ee16983502fa
SHA1 fdbc603b4db1c31a9ce8a2fd7a9762058f70bd6e
SHA256 2b2a1cec02d3ceff888429ebd5f4bf95cef7e2a5b09227b54d8f8cbe2b061ecf
SHA512 69f867868238cb297d13f3a40a01d0898de76db3286bc21d745e55f6bde237469d96654f3da1618183250ca991061d041ae75ca9e5e63a2247cbb13286cb78ee

memory/4912-11-0x00007FFFD8950000-0x00007FFFD9411000-memory.dmp

memory/4912-12-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-13-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-15-0x00007FFFD8950000-0x00007FFFD9411000-memory.dmp

memory/4912-16-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-17-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-18-0x0000026234D20000-0x0000026234D96000-memory.dmp

memory/4912-19-0x00000262350A0000-0x000002623514A000-memory.dmp

memory/4912-26-0x00000262347A0000-0x00000262347AA000-memory.dmp

memory/4912-28-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-30-0x0000026234610000-0x0000026234620000-memory.dmp

memory/4912-31-0x0000026234AE0000-0x0000026234AFE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

\??\pipe\LOCAL\crashpad_1448_XRCQHWLJNDXIJHZD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a7a14abe1371a6ff0f636e20deab0fd2
SHA1 1891beacb7653ac5d776da1ae88df3cc7634d94d
SHA256 f1ad714263ecc5be071b12d840015f964d718c95dd862a1b9e8b27aaedcc2b51
SHA512 3bcd4188e57736ac4a5e891762060f44c7d95413e21ce797817afc4479672d9072e4d9dafed1695870380fda2f2857a820478cae873f601a1ffe45c1c49b7f8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4573d1a1c1e51abd3278a26b6c1b34e5
SHA1 fce8166e8aef37d28912939148594256d57badf0
SHA256 ca210f477ce7631046aa69f9551c5c230a493e0ac2d7739b246f2410b40859f7
SHA512 e1942ff8490b1a15743f6ceae375df8aba8b2dcf316a40065577069e7e4b0a090104b0625548f9f1359ccdd5582a6b3b30498571891b59c8e68455b809f9cef5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3c706dd294060a616efaa2efee3760f7
SHA1 913aa77545ac95f3a8e3a1e4a7d4fc22a0d9bd0b
SHA256 e5a8ed87eb0277d8b93d02f1cda71ec49e0ffa34a46fa28314ff52c4b4d41426
SHA512 5b79be6bba0615de5fcd2d4d900c00a069086967b1c9a703dc741dc227729ab2ccfb8ed4e692636f316688af4125069cf620d9298dd9726e37e89a701d9ad29b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 699e3636ed7444d9b47772e4446ccfc1
SHA1 db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA256 9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512 d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 20c9c1401684fb8593034297cfbcfe89
SHA1 94cf28b9a51f9f6786155485e3be545ed1dd77c6
SHA256 2a6b5296bd352f52e7c3d7223f77a7c62aa26480b97e6a2642b00ec7d3962067
SHA512 072684cff42d7e62cbccf248dd3bb75a2005d903c401dd97396e2a569e349083d57e647888a9fef4e7fba629d3b94c11645041e8670aa8323e3825578b86b900

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a445.TMP

MD5 e9c29f693a37145d59ce713a551175fa
SHA1 9df03942845dac438a6042421234bb3e54999c33
SHA256 21d3b61df467fb34dc1d440999c17ed5f7f8bf63649c604bf2fc6beef954ca0a
SHA512 4ac464566306649eb61a4da5e871c795048e0023dcca25916ad06f6385d581c15f0b0df3682ff72c96221633b921174a21cade3070c9f7b600e639e3633b5b0c