mystic | cf09565fd33a74ca430aa23ecfeab197d1a2ba498577f7b8c08daba846ce34cd

Analysis

max time kernel
154s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9af7358979fd621cf352016fb15e5bc0.exe
Size

917KB
MD5

9af7358979fd621cf352016fb15e5bc0
SHA1

4aef20d5c4704d8ab3defe5203a92b1aa2d790ba
SHA256

cf09565fd33a74ca430aa23ecfeab197d1a2ba498577f7b8c08daba846ce34cd
SHA512

40b5f086074d8cc362dc8d1e80a9fc5ff8bb0eae074e7d2b47df83d49eafcad9092ef8634b9ccee653122e9c874cac58661e03749fb54df26620a1de6636a1e0
SSDEEP

12288:8MrOy90utPPj0GnUMm0NldH2laex4IC5ipCPHGkiPLvTMXiYQ5DRwAyBxhwumJEJ:qyZX4NMV5AaeuIseC/GRLYDPqnEix4

Score

10^/10

mystic redline taiga paypal infostealer persistence phishing stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/6972-439-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6972-440-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6972-441-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6972-443-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2116-575-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1616	KC4Ym62.exe
4724	3Hb438hu.exe
6064	4or8gT5.exe
3336	5se38PQ.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.9af7358979fd621cf352016fb15e5bc0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	KC4Ym62.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000022dd8-12.dat	autoit_exe
behavioral1/files/0x0007000000022dd8-13.dat	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6064 set thread context of 6972	6064	4or8gT5.exe	142
PID 3336 set thread context of 2116	3336	5se38PQ.exe	153

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4400	6972	WerFault.exe	142

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
1492	msedge.exe
1492	msedge.exe
3332	msedge.exe
3332	msedge.exe
4244	msedge.exe
4244	msedge.exe
4564	msedge.exe
4564	msedge.exe
5748	identity_helper.exe
5748	identity_helper.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe
5240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4724	3Hb438hu.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4724	3Hb438hu.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4724	3Hb438hu.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4724	3Hb438hu.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4724	3Hb438hu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1616	868	NEAS.9af7358979fd621cf352016fb15e5bc0.exe	86
PID 868 wrote to memory of 1616	868	NEAS.9af7358979fd621cf352016fb15e5bc0.exe	86
PID 868 wrote to memory of 1616	868	NEAS.9af7358979fd621cf352016fb15e5bc0.exe	86
PID 1616 wrote to memory of 4724	1616	KC4Ym62.exe	87
PID 1616 wrote to memory of 4724	1616	KC4Ym62.exe	87
PID 1616 wrote to memory of 4724	1616	KC4Ym62.exe	87
PID 4724 wrote to memory of 4900	4724	3Hb438hu.exe	91
PID 4724 wrote to memory of 4900	4724	3Hb438hu.exe	91
PID 4724 wrote to memory of 4564	4724	3Hb438hu.exe	94
PID 4724 wrote to memory of 4564	4724	3Hb438hu.exe	94
PID 4900 wrote to memory of 3108	4900	msedge.exe	93
PID 4900 wrote to memory of 3108	4900	msedge.exe	93
PID 4564 wrote to memory of 2284	4564	msedge.exe	95
PID 4564 wrote to memory of 2284	4564	msedge.exe	95
PID 4724 wrote to memory of 1204	4724	3Hb438hu.exe	96
PID 4724 wrote to memory of 1204	4724	3Hb438hu.exe	96
PID 1204 wrote to memory of 5020	1204	msedge.exe	97
PID 1204 wrote to memory of 5020	1204	msedge.exe	97
PID 4724 wrote to memory of 4204	4724	3Hb438hu.exe	98
PID 4724 wrote to memory of 4204	4724	3Hb438hu.exe	98
PID 4204 wrote to memory of 1956	4204	msedge.exe	99
PID 4204 wrote to memory of 1956	4204	msedge.exe	99
PID 4724 wrote to memory of 5108	4724	3Hb438hu.exe	100
PID 4724 wrote to memory of 5108	4724	3Hb438hu.exe	100
PID 5108 wrote to memory of 1104	5108	msedge.exe	101
PID 5108 wrote to memory of 1104	5108	msedge.exe	101
PID 4724 wrote to memory of 3772	4724	3Hb438hu.exe	102
PID 4724 wrote to memory of 3772	4724	3Hb438hu.exe	102
PID 3772 wrote to memory of 4176	3772	msedge.exe	103
PID 3772 wrote to memory of 4176	3772	msedge.exe	103
PID 4724 wrote to memory of 1508	4724	3Hb438hu.exe	105
PID 4724 wrote to memory of 1508	4724	3Hb438hu.exe	105
PID 4724 wrote to memory of 980	4724	3Hb438hu.exe	106
PID 4724 wrote to memory of 980	4724	3Hb438hu.exe	106
PID 1508 wrote to memory of 556	1508	msedge.exe	107
PID 1508 wrote to memory of 556	1508	msedge.exe	107
PID 980 wrote to memory of 1884	980	msedge.exe	108
PID 980 wrote to memory of 1884	980	msedge.exe	108
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109
PID 4900 wrote to memory of 1676	4900	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\NEAS.9af7358979fd621cf352016fb15e5bc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9af7358979fd621cf352016fb15e5bc0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KC4Ym62.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KC4Ym62.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb438hu.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb438hu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,7573261512918318482,2597627904351474626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
        5⤵
        
        PID:1676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,7573261512918318482,2597627904351474626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:2284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
        5⤵
        
        PID:3388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
        5⤵
        
        PID:4504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
        5⤵
        
        PID:6272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
        5⤵
        
        PID:6256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
        5⤵
        
        PID:6352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        
        PID:6712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:6700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        5⤵
        
        PID:6916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
        5⤵
        
        PID:6992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
        5⤵
        
        PID:7032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
        5⤵
        
        PID:7000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        5⤵
        
        PID:7160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7232 /prefetch:8
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:1
        5⤵
        
        PID:5912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7232 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
        5⤵
        
        PID:1308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5532 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4724062225185815994,16983284429548716558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
        5⤵
        
        PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1248940164270708794,5369640602236145486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:2332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1248940164270708794,5369640602236145486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4372434137717725541,13142676469264035572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4372434137717725541,13142676469264035572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        5⤵
        
        PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16093854555706883377,6300722997981709362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        5⤵
        
        PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
      4⤵
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:5608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
        5⤵
        
        PID:5648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4or8gT5.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4or8gT5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6064
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:6972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 540
        5⤵
        Program crash
        
        PID:4400
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5se38PQ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5se38PQ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb01a646f8,0x7ffb01a64708,0x7ffb01a64718
1⤵
PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6972 -ip 6972
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ed1059501887ca58bf7183147bc7e9bd

SHA1
2f3fae395180943a637a4ae1d3a4b374b5a13a42

SHA256
1292a748aa1f19560e5a5faee5d5c8d8e69fd5ebd83fb10451b8d213d085cd89

SHA512
d1f3897075f8c30c35ffd1aed9d60345eb924f362d50c5b35352a4e6a51cee770cb0b37394eb81d593644edf3fcb9c1b576f7db499226a9468e5b5f530dc734b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ed1059501887ca58bf7183147bc7e9bd

SHA1
2f3fae395180943a637a4ae1d3a4b374b5a13a42

SHA256
1292a748aa1f19560e5a5faee5d5c8d8e69fd5ebd83fb10451b8d213d085cd89

SHA512
d1f3897075f8c30c35ffd1aed9d60345eb924f362d50c5b35352a4e6a51cee770cb0b37394eb81d593644edf3fcb9c1b576f7db499226a9468e5b5f530dc734b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ed1059501887ca58bf7183147bc7e9bd

SHA1
2f3fae395180943a637a4ae1d3a4b374b5a13a42

SHA256
1292a748aa1f19560e5a5faee5d5c8d8e69fd5ebd83fb10451b8d213d085cd89

SHA512
d1f3897075f8c30c35ffd1aed9d60345eb924f362d50c5b35352a4e6a51cee770cb0b37394eb81d593644edf3fcb9c1b576f7db499226a9468e5b5f530dc734b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f30b8232b170bdbc7d9c741c82c4a73

SHA1
9abfca17624e13728bd7fa6547e7e26e0695d411

SHA256
0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb

SHA512
587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
17f71cc165ef16b05d397247f1e2d82d

SHA1
ccf5501517b5fc44bc8279dc5521a67bf6dac787

SHA256
e9286df6d5d84f57773d9dc24c982c746e53cd90a2903fa67a9112506450569d

SHA512
fc8ffdee3a9a5aab51d5ac1885f7c2698fab6aae31dee075e54cc38304e9bc067b3572f088b0bb24a095e005118ae76b33b85bb54a89ff211f04dcfa3ad3ec91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a8258c72d8f8cbca900f1229f8d0df7f

SHA1
5cdc67d2b78518ebbffcd2671d743fe531c3a632

SHA256
7f42cb75314a6a447cc07cc729acee55134e48b60db27ab2b5a0827a162d9a72

SHA512
65abe513693ee86a18d5a4eea9763ac6cac94082c328ca79c3a01a7dc3b5ef7d5e444b96aec88a6fb22d48a4a1dd6ffd5684f4a142d9e8a3aed8f7c45f09a2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ea42f948b377a21b640fa675f598c829

SHA1
387c80cfdc909a597b660ca05d404d3b0b92ef5a

SHA256
d5466b567a35669ee200d70942f6b6daf03dbff61e843921e7c07f40c1f80390

SHA512
2998a3b546ed18afa913878327744fa746ffd45e4f149c32ecea9a1e91541f14f8dfdeeab3badbd0233cafd5c3a5bdc76918318d0bf1d555f69659d7c1cf2f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e3ff9a636f0d18f669680a4b63d1f31

SHA1
c2f76e47b403e59eb996aa37fd7f90854e64ef6c

SHA256
de4c92c782893f61ff87090287fdeadd1b7e1547c3d9284da4441b6297767017

SHA512
fccb794d336af2fafb7b86337ea5b0145a4253eace7f14b003f815f9bdd21f2b822447639e2a2226c520abc99ca0e296743f9363a921fc83053411257e73c0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
958d57c28fb208241eed828bb58b88f2

SHA1
5f0f857db947d186857719acbb0f05e1e51484c1

SHA256
d8796f0be8f06804109292b8490420fabb694b5b8fd399249ade98a87fca017c

SHA512
becbd74a46bbcc07e9014b4e558121be34e1a5b37fe426463d9cecce320bd36088b23485dd4abb8bbef6a4d1e15736612f322a2e0dbd5e289f9aebba00e3aeae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2defd74ba1d824bb1e1c390f144f1a66

SHA1
25d49dacc60ac2a7d70b5a45a7061a3080c178c6

SHA256
ee5f4a4f68b567d2011674373b3ee85063fbe7428181e9f405a325124f8dc5d8

SHA512
e3063b3d032f8a0bd346df28ff74e54ddedd94e5a93c63b3084010fe81adc193f9692166264f2f51c3473be2466b7a294ca2efec4b9045cc9f3523ed9973ea95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8abe9b2d273da395ec7c5c0f376f32

SHA1
d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec

SHA256
3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99

SHA512
3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\554b4f36-3adb-4c1f-869e-ba5db1b786ed\index-dir\the-real-index

Filesize
816B

MD5
95c6263522b5f30ac66a1256a8ebf28e

SHA1
15eb769855f61420c43954c0309b6ac8573f8cf8

SHA256
67225ca06448cc805972488b6ac4eb4c02c154cf25a417e6a688dcb778c3031f

SHA512
79fcdc78ed72a8edff67d34cb6475d94af504fbd8baaafcaf887eba5c893a0cfd8a1de895397016f3a6544c2b018cdb00c65e14e2b0231f488f0330f6e8aaf07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\554b4f36-3adb-4c1f-869e-ba5db1b786ed\index-dir\the-real-index

Filesize
792B

MD5
12a1aac260085158d6d06ab455d3930f

SHA1
08d1ac133301d392b92bd142a9dc63f119a02a3c

SHA256
79b956730f926cecc219d8f999120b31982f1914590f9c92268e0bea47321126

SHA512
7fc810a5b62a2de2bf5f9057c3b97fc9ff78ba0ad0bdc258f021760ff200f26e42a006c52da97a8504ef743653048b068d141624b650eb4a8b986f7eeaa4f662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\554b4f36-3adb-4c1f-869e-ba5db1b786ed\index-dir\the-real-index

Filesize
984B

MD5
493244d05aa2e642fbd47722e4f6f505

SHA1
392313d6ebf097a5e32a1887831cdf00443f4f67

SHA256
dd4d15c9a94ae2a365346c4aca06f781c286c80e028472dcb4fffb6629e94729

SHA512
fd81e9d3bf0516565b0b043b5962930976785f65cd03a3d2c1821e2fac425c4388323137e80b92a8167b002111e576bb69feaf3a0e2ca2dd1ca765305ee7ea46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\554b4f36-3adb-4c1f-869e-ba5db1b786ed\index-dir\the-real-index~RFe588c4d.TMP

Filesize
48B

MD5
469ef3f9570be0985fafdf5ea9258085

SHA1
d3e695e586bc8370a1a41eed054ffd422e0beddb

SHA256
4d64e6a33c3fdd118ac2f659acd266cf2a454b486e3abb311fa9c4ef981d34dd

SHA512
66a0611a4f44f05793571b698d590406032c287ed24f0c361cd4439fe0d92f6d9b2ce8270b667fabdb1db2d474c21b93e6baafa3926e04ed36a4808b2a8990b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\f875dd18-d99f-4b70-807f-a3971f973421\index-dir\the-real-index

Filesize
72B

MD5
3df75a2271a265a87be2f7cd6f238895

SHA1
a1da6f7a715dac6a2be67e90df7b268ce108c8e8

SHA256
6a23fa87e2b129741ad34592bb6a4245a7c9b3072dbd66ae992bc88169f2eb91

SHA512
ef8895d91c95919d57b3b6217ee228cf492a6973c9a429fb4a9b7f8d0b1444335ae8fedd322dc72dcd84f20b15550bad8dc550e41d008e2683ce7f6b9bccd32d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\f875dd18-d99f-4b70-807f-a3971f973421\index-dir\the-real-index~RFe582eac.TMP

Filesize
48B

MD5
a527dc28f44bd46544eaccd84abed1d3

SHA1
760150748d129e6106dfb1f57b2381e9cf60fdc5

SHA256
9cb76e6754ab4258b12f950c5f9159331d451c3481370e3546594fd79c76001f

SHA512
5e37d5a441d4e8d71f196c4aaa26b832593d4af4c05c3f06af67d29308291066b6369240446458be798d4532e1ffb6c51eb0b7d6e466546c5e29e2359f8be61f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
138B

MD5
1ce23d81d9572560cf21c642136e9091

SHA1
3f7784a654a76509eff8abe1e4ef4051c4ecf3d0

SHA256
af8e18a346550f1b656dc44a48929b62b4da5e4bc1548e50131f9bcddad3ee26

SHA512
6ec9c15f45ccd81619fff61436a2c3ccc6841f35619655636f9745a54d7a8e6fc915357a39081074e3e830ff2fa4475da250b7d33cda3e72126ee71931f58733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
147B

MD5
0fe133bb326e71121862540738bb009d

SHA1
bd918f2b4c71ea4879a7c4f3f0b72812d19e2234

SHA256
c42786c4d1593906439829e610cd53e0ea14a22ce5574f02d3109efad3f66bd5

SHA512
3108c21bb2f4b2fd1352c84b99b100ed1bcd34410e650536fcf011d5e5904d253e1b3cb2d04acf2bc253e31118686f3d0f3a6326a372a24d91c91c4365d16cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
138B

MD5
59c51e09f2975e15b6ccd6434543ca8d

SHA1
e0455504cb79eebef0211f1fea0772e13b4c6d02

SHA256
abc76d5dad47838792390936f4fe674dab77e9e625afe558c3f4532774880ed6

SHA512
a2ed65e8a1d75f74ceae29ca83d3f144f8ef9e348aba99e67900c15ef58e37d43ee8261f9697e2f4683b1c0067f51917410cd71e626079b1f5c2512acc0b79c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
138B

MD5
0360a5d0393c6c8818dd1ebdc77858f2

SHA1
90ad8f3499360b4fc5a256ba2f5201a28fe8228f

SHA256
350d3f1852d44b401d5fb44562233e893ba49d2fb3cc910645d63db27ccb2693

SHA512
ae68e6fceb0cc34c9cfbf29a3f77940a8222c730e2aa1d516c786e348bb395ed0ed20594ca3af196ad7896815383664067f432df4524f4b198924deb683eebdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe57dddd.TMP

Filesize
83B

MD5
42634cd2d34007b1786d80dccbb8976e

SHA1
3b22e676947ffc399c7e6e227f12358f18aaf0c9

SHA256
dab1daece997f6b86fc4d53189dfa0ad214e074e3f793030963970577af9525f

SHA512
b62761dc36225e502723382a52f9818f4a2d51d4f32b061fbfaa66ede7048e4826e0a420d4ef3afd31a84cbc366da29586d3072eda6ad52a92d1eb87caed23e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
f3b9655e5c8dae7b649a6f232843d6da

SHA1
4724ebbba0bb0d9c9df2d127ae6fde2c2632ae12

SHA256
930a009ed10d39129dd94546f565dd7eba97c44228cc1b3cf12dd3788efc63d5

SHA512
678c074bdedde4c148c5f08f44346643fdd6be5b1fd04e37dbbe70b46b6a2af1d0755f424952141e340cdac0432392fac42e5976367a24b4f1dcf23af9ca6268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58393b.TMP

Filesize
48B

MD5
adcd97caca36a643cb6507891c116bff

SHA1
7b649e07275cae9cc3d5b82c98cab6b841ca59ed

SHA256
171b2af3c2e23847a2e6b162bfc66ffa0e700cf53fe7900b0c5e764d9feb64d5

SHA512
3384fae947b77f3c39b687e060707243af30b61cd99ec85f0bdd3c9bcdccef5989da01ea3d9fcb308af38ef830c0f4c93e2e8c717456132c66e12accd191a3be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1dcbe9533ade5e2f649e7306479bd5d0

SHA1
be2eb14498bc58256cde41bd992a14297d1f90a2

SHA256
59ba98ed0649bcce44eea26c37185725e1b62bff541abb1f5e869d1162a3ed95

SHA512
b5ecf99815a135d753a4bb4b363a1e84d8be30f53569a1118a45dc919707e3b9a15ce2dd8d21ac94be69d686752ff64c01500507365a27648091e8670e994fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
647971953c46945e22a9ee9c743d8bf1

SHA1
5c7b8a9204c49da517209d755860765c17e85df2

SHA256
3d2d8f583770b616f7caec03c72f17200d6ff0305ddff95a94ccdafa6ce09ea3

SHA512
e17dfbbce64f31a11ff4e1ba5ad299bdac31e2ef8cda410189801394e6f88557ec9b6e3ba6556ac2aa9f189f188771bab34789b2891548975ee0e4e8f8c0f0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ec63cf4c131c324679903548f97f87e3

SHA1
0f351922091ac4d0382a8628b915b84d85c0f951

SHA256
b4377e2e34c3069c1c8bc4c143e9a6895d424c04f85e45df487ac0897bf45c74

SHA512
505e8b9a51bf93d16b2a35e834e8b2c2ad8fbe1ad146bed5e282c57c1fdb950a589002165b8b237433853a725d937dd9943ea50e5881fafc5c7cf39a2e1a4488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a6861f90635f82a21de1cffac14622b5

SHA1
08f7bd778e68fa03fa99b34fa5bbf73ac69c34c6

SHA256
41f0f5aacb15610f2e8ecc7f5721439c3a33425d74c0f71dd9f5c00389829192

SHA512
e2535d5c7ee5cb61e68bba9f271677fc7058c1082a3405cccd8e215fdd70a773645cdbf50e2cf12cc45fc7d5a9829d7232001ad7d8a823de17c1d56201ca0dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5e1645d9242f688d04abb39aa9313087

SHA1
2de9451faf9caea32d15295ef25b2356f6516493

SHA256
c40ea7947e7991b23eb0f8cea7e9b748b89d59c310f04eeb474ce872f4ac083b

SHA512
ba6ec6754d08511ef07b0d2ea3df0be0c8cd1827cfc2ae9a94affff0ada208912e7c6cc13b463255bf44fada90a56c4cfa98319860d933b847b1863f0a5be861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cfd0277f5b666fe6470b35eb11e2b5bc

SHA1
8edb8f7a1ff9e6b77f36aade14f3f1bf75d53fa0

SHA256
77074f995a4defa287332b0c533c04f0aa7ddf471b0401c45614918a39854e6c

SHA512
b1009835cee5f871d7b2b0bb1b211c053016e731b6907d47f46972107f2075326baa1405410f0ab20112492da2c3b05caf525b956c643684d5883dc36cd1b02e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
277755010da7c8472097dba65b77e7d2

SHA1
e807aeec454fd08b529e66f4564ff3686ba98658

SHA256
ebbcfd4dca800cb75bf2802dc76816b7f30e2240db6b7ac083f3d26fe5d26341

SHA512
c041b882898f909bca34436477a83e07637d53f4eaf7da59ea02a67386362ebf6049b35801cda54fb30cc8485addab353987974571ebca0e9e427447cf14dd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
952c82865f6026837649e8b4c4a7c763

SHA1
6c859a3562f125fd719febd2c0714b7fed9ebdf4

SHA256
7d8971ef53577eeef36613965e1098d33b367ae21df3875aea744d9843771e4f

SHA512
62cf28bae0da50f4754babbb8f12ac1b24b2b952ced1a6b22517c922eb71251fa6a23d6c76d3d291a70382772c885aa9fdd1b847ab20916814e0be097be40c1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d33.TMP

Filesize
2KB

MD5
71aba08e339bf531fbdc07722f5b2850

SHA1
b11a807f4d844180d0f01735896b53041fb5c45b

SHA256
ede93a00a9187c2090cf957e18eb794e7458096c7b43f944b99f247f4b2be902

SHA512
6273cf76bfa3a7019715a3fbe0d2c4ceeb5bcd64620ff4d2d4938df568609dc6e366806775b95b10ddc9043dc07c3271e9c5bc1c25f11bc144b74aadcce9f9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5832ee419d7cae21b01c346df427d117

SHA1
4781f2312bd3747080b130e49364c0471bda1a43

SHA256
dc48f8ca17acb52e21a58cd127dad29a16d162a31671bd0feb38e4f816116b5d

SHA512
f6018a7635f9c3b19600c8bbd071a88d206f3303b32630cfee3685dff66df78300f9751fe90538347cf126408fad18852ef0a6f8ab2dac285108e8789d877c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5832ee419d7cae21b01c346df427d117

SHA1
4781f2312bd3747080b130e49364c0471bda1a43

SHA256
dc48f8ca17acb52e21a58cd127dad29a16d162a31671bd0feb38e4f816116b5d

SHA512
f6018a7635f9c3b19600c8bbd071a88d206f3303b32630cfee3685dff66df78300f9751fe90538347cf126408fad18852ef0a6f8ab2dac285108e8789d877c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
e577ded5bfacfac7920c1a5426d4dc6d

SHA1
1dc7cf12aaf44a6a73f149787d703140a528bd03

SHA256
f82a9244a4deb9f8819799bcb3dd369b7f3e752a2746d734d8685cf62f2876fc

SHA512
d28c43391d785e99c406cf4f0e82016d81af33b25243c2c63e7dc01f74a3517e4ffaca8ccc72cb62f897ac661ea3d67a14f97a096388edcd6650427be2c796b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
f7b920255323c4229e36833a3aceeaa2

SHA1
dda0170029b2f5c0c922bf31b020654b8d4267ca

SHA256
576741861e7b8fda16a7a0d320d55ebaa3da6283dec32bd453d0b99b23a783d2

SHA512
5ea385805d34b451aafa5800cabc2c072536d74af7a708e006136e64dc8a14bc764b7cb837ed1613299030bb1cb03d763df494b307d75142e06ed900eb27b2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5832ee419d7cae21b01c346df427d117

SHA1
4781f2312bd3747080b130e49364c0471bda1a43

SHA256
dc48f8ca17acb52e21a58cd127dad29a16d162a31671bd0feb38e4f816116b5d

SHA512
f6018a7635f9c3b19600c8bbd071a88d206f3303b32630cfee3685dff66df78300f9751fe90538347cf126408fad18852ef0a6f8ab2dac285108e8789d877c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5f3484985ad017b457ac891c16f4b42c

SHA1
5ca95540db4269e367a33f7356f3fe11fff66dc4

SHA256
a0f7269406d636be4d6bc7f87896169603eaef67f1c51b9a436a455c57c1bc09

SHA512
443660e42fed31d3546034a56627d779ea4fcd1f58f28189ccb3090a23d7ac62e236eb685d7b3b2313219b3ad951a245045107e80b249be2b32824c1d39b694c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
f7b920255323c4229e36833a3aceeaa2

SHA1
dda0170029b2f5c0c922bf31b020654b8d4267ca

SHA256
576741861e7b8fda16a7a0d320d55ebaa3da6283dec32bd453d0b99b23a783d2

SHA512
5ea385805d34b451aafa5800cabc2c072536d74af7a708e006136e64dc8a14bc764b7cb837ed1613299030bb1cb03d763df494b307d75142e06ed900eb27b2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
39f8a85310f83356ff3ce51d2a692e1d

SHA1
ce6f4e48d7eeac88cabb6c493c5a6e60f00d5c6d

SHA256
a029e672b88984a1974fe4d2a550bdb6e4f9dce2e41d0c1141034232d35338c2

SHA512
9f0a22971bbd1150f3d849ad45e76d979d40a97ab4a1c64a84af32fb1573ffe007d48ea89e7a17afab3e30bdf483cccaf4c1db0da0f3141152c82895cd9ca4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
e577ded5bfacfac7920c1a5426d4dc6d

SHA1
1dc7cf12aaf44a6a73f149787d703140a528bd03

SHA256
f82a9244a4deb9f8819799bcb3dd369b7f3e752a2746d734d8685cf62f2876fc

SHA512
d28c43391d785e99c406cf4f0e82016d81af33b25243c2c63e7dc01f74a3517e4ffaca8ccc72cb62f897ac661ea3d67a14f97a096388edcd6650427be2c796b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
39f8a85310f83356ff3ce51d2a692e1d

SHA1
ce6f4e48d7eeac88cabb6c493c5a6e60f00d5c6d

SHA256
a029e672b88984a1974fe4d2a550bdb6e4f9dce2e41d0c1141034232d35338c2

SHA512
9f0a22971bbd1150f3d849ad45e76d979d40a97ab4a1c64a84af32fb1573ffe007d48ea89e7a17afab3e30bdf483cccaf4c1db0da0f3141152c82895cd9ca4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dee29f4c-dd75-46c8-bef8-f89ee6f409cf.tmp

Filesize
2KB

MD5
e577ded5bfacfac7920c1a5426d4dc6d

SHA1
1dc7cf12aaf44a6a73f149787d703140a528bd03

SHA256
f82a9244a4deb9f8819799bcb3dd369b7f3e752a2746d734d8685cf62f2876fc

SHA512
d28c43391d785e99c406cf4f0e82016d81af33b25243c2c63e7dc01f74a3517e4ffaca8ccc72cb62f897ac661ea3d67a14f97a096388edcd6650427be2c796b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5se38PQ.exe

Filesize
349KB

MD5
d2997ba3a18ffcf0edca32e435ca0617

SHA1
f0513e926e5c54a42f15553fa9e5d82b7a1649d4

SHA256
604b5982349d1c7992ce3b9e38b088921a952c7ec4e7b2d08711af3b16ff4ae2

SHA512
c949216b3a1ea1c653cf1177142756647aad9ca36b525483bc980112890f22ec1b2e121158f8bb864ae3cdd8630a45d2d90d5f8e350347b266da0489d6313e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5se38PQ.exe

Filesize
349KB

MD5
d2997ba3a18ffcf0edca32e435ca0617

SHA1
f0513e926e5c54a42f15553fa9e5d82b7a1649d4

SHA256
604b5982349d1c7992ce3b9e38b088921a952c7ec4e7b2d08711af3b16ff4ae2

SHA512
c949216b3a1ea1c653cf1177142756647aad9ca36b525483bc980112890f22ec1b2e121158f8bb864ae3cdd8630a45d2d90d5f8e350347b266da0489d6313e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KC4Ym62.exe

Filesize
674KB

MD5
4a24f54357d7549fc40c938b444e5fd1

SHA1
9de2d76b156d497a8e4862db5a9cab5d4a7a5b55

SHA256
4d548737d49087326979108dfe59a16618af18519ce10a0874cd72e654e6c745

SHA512
2e11e6c106fbb5da95ae348db1e8b38feef28b8559f7f283192295ece2575f31612afddd2cc375626e83bf5098b462e58686ad206e2e49131dafbad574e5e692

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KC4Ym62.exe

Filesize
674KB

MD5
4a24f54357d7549fc40c938b444e5fd1

SHA1
9de2d76b156d497a8e4862db5a9cab5d4a7a5b55

SHA256
4d548737d49087326979108dfe59a16618af18519ce10a0874cd72e654e6c745

SHA512
2e11e6c106fbb5da95ae348db1e8b38feef28b8559f7f283192295ece2575f31612afddd2cc375626e83bf5098b462e58686ad206e2e49131dafbad574e5e692

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb438hu.exe

Filesize
895KB

MD5
94a5d771548c6e00b278a4405d402684

SHA1
ba1addb060b6fc1866ee1bd87da892be2233b17d

SHA256
c80e293f308132a53795de49d47f6c5f1629c6cf03102d14a36f4e14955d1915

SHA512
09131c71dcc03451b147a35772bbe036415fb5853aff5c0d457e0d373ec3e50fa0545288a025affdf997942c2268dcef6217d6b6abf52b7e454816a45f34dfb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb438hu.exe

Filesize
895KB

MD5
94a5d771548c6e00b278a4405d402684

SHA1
ba1addb060b6fc1866ee1bd87da892be2233b17d

SHA256
c80e293f308132a53795de49d47f6c5f1629c6cf03102d14a36f4e14955d1915

SHA512
09131c71dcc03451b147a35772bbe036415fb5853aff5c0d457e0d373ec3e50fa0545288a025affdf997942c2268dcef6217d6b6abf52b7e454816a45f34dfb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4or8gT5.exe

Filesize
310KB

MD5
be1bfea5365b83f8a65725d0c0e52d87

SHA1
c204d073318127e8fc6d86adc0e82d37a3353d6c

SHA256
410b4f1818f524a1dfbfab8e86c24f2b9747f90d81a592e5b5f31ed0038a258d

SHA512
ecaf26a1ac720235226819c8ff452fdd9b20d3a755a6c02a224968c7ae9ec417ce6fb633c04992516d3eb769d661fa89ae1c0404b9284c166b348fc96201cd9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4or8gT5.exe

Filesize
310KB

MD5
be1bfea5365b83f8a65725d0c0e52d87

SHA1
c204d073318127e8fc6d86adc0e82d37a3353d6c

SHA256
410b4f1818f524a1dfbfab8e86c24f2b9747f90d81a592e5b5f31ed0038a258d

SHA512
ecaf26a1ac720235226819c8ff452fdd9b20d3a755a6c02a224968c7ae9ec417ce6fb633c04992516d3eb769d661fa89ae1c0404b9284c166b348fc96201cd9c

Download Submit
memory/2116-853-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2116-897-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

Filesize
64KB

Download
memory/2116-867-0x0000000007910000-0x00000000079A2000-memory.dmp

Filesize
584KB

Download
memory/2116-862-0x0000000007E20000-0x00000000083C4000-memory.dmp

Filesize
5.6MB

Download
memory/2116-575-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2116-983-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/6972-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6972-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6972-440-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6972-439-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download