mystic | c741e309cca1439b9dde1d6c5ad9678582165daf6370aaf4c13c05cf36441cd2

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe
Size

882KB
MD5

c2874e64dc4a713e5f1a394c132d9382
SHA1

f8e8f6448660d3bde3affda3a4534e24d2bd6074
SHA256

41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975
SHA512

95c339e5bab30ea79de68e97ab6ea06cc0520807610bcf9b25267b8150b718078b28243a5347e51ad89f09fc736bd35cb077222b576992e6361b64b7ec316b45
SSDEEP

12288:tMr1y90Jd4rJMuNnRX3l8dI2YcKoPLByw4yNkz1sLw1m5pPT4zVyc8kvjRMbHaCE:oy44plHolDkz1AIeCzAc9yJIixO+8

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4496-33-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4496-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4496-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4496-34-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2220-46-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	5Jb8fK7.exe

Executes dropped EXE 8 IoCs

pid	Process
3836	eR7cC46.exe
4080	NH5Jt10.exe
2104	VH4zj36.exe
2132	1PV08BV7.exe
4508	2Re2210.exe
3884	3gY89Th.exe
4288	4Sw518nV.exe
3500	5Jb8fK7.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	VH4zj36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	eR7cC46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	NH5Jt10.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 3928	2132	1PV08BV7.exe	93
PID 4508 set thread context of 4496	4508	2Re2210.exe	101
PID 3884 set thread context of 5088	3884	3gY89Th.exe	108
PID 4288 set thread context of 2220	4288	4Sw518nV.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1856	2132	WerFault.exe	91
4864	4496	WerFault.exe	101
368	4508	WerFault.exe	99
3152	3884	WerFault.exe
3184	4288	WerFault.exe	111

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	AppLaunch.exe
5088	AppLaunch.exe
3928	AppLaunch.exe
3928	AppLaunch.exe
892	msedge.exe
892	msedge.exe
2764	msedge.exe
2764	msedge.exe
832	msedge.exe
832	msedge.exe
1372	msedge.exe
1372	msedge.exe
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
3484	Process not Found
572	identity_helper.exe
572	identity_helper.exe
3484	Process not Found
3484	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5088	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3484	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3836	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	87
PID 4720 wrote to memory of 3836	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	87
PID 4720 wrote to memory of 3836	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	87
PID 3836 wrote to memory of 4080	3836	eR7cC46.exe	89
PID 3836 wrote to memory of 4080	3836	eR7cC46.exe	89
PID 3836 wrote to memory of 4080	3836	eR7cC46.exe	89
PID 4080 wrote to memory of 2104	4080	NH5Jt10.exe	90
PID 4080 wrote to memory of 2104	4080	NH5Jt10.exe	90
PID 4080 wrote to memory of 2104	4080	NH5Jt10.exe	90
PID 2104 wrote to memory of 2132	2104	VH4zj36.exe	91
PID 2104 wrote to memory of 2132	2104	VH4zj36.exe	91
PID 2104 wrote to memory of 2132	2104	VH4zj36.exe	91
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2132 wrote to memory of 3928	2132	1PV08BV7.exe	93
PID 2104 wrote to memory of 4508	2104	VH4zj36.exe	99
PID 2104 wrote to memory of 4508	2104	VH4zj36.exe	99
PID 2104 wrote to memory of 4508	2104	VH4zj36.exe	99
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4508 wrote to memory of 4496	4508	2Re2210.exe	101
PID 4080 wrote to memory of 3884	4080	NH5Jt10.exe	106
PID 4080 wrote to memory of 3884	4080	NH5Jt10.exe	106
PID 4080 wrote to memory of 3884	4080	NH5Jt10.exe	106
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3884 wrote to memory of 5088	3884	3gY89Th.exe	108
PID 3836 wrote to memory of 4288	3836	eR7cC46.exe	111
PID 3836 wrote to memory of 4288	3836	eR7cC46.exe	111
PID 3836 wrote to memory of 4288	3836	eR7cC46.exe	111
PID 4288 wrote to memory of 2176	4288	4Sw518nV.exe	114
PID 4288 wrote to memory of 2176	4288	4Sw518nV.exe	114
PID 4288 wrote to memory of 2176	4288	4Sw518nV.exe	114
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4288 wrote to memory of 2220	4288	4Sw518nV.exe	115
PID 4720 wrote to memory of 3500	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	119
PID 4720 wrote to memory of 3500	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	119
PID 4720 wrote to memory of 3500	4720	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	119
PID 3500 wrote to memory of 1060	3500	5Jb8fK7.exe	120
PID 3500 wrote to memory of 1060	3500	5Jb8fK7.exe	120
PID 1060 wrote to memory of 832	1060	cmd.exe	123
PID 1060 wrote to memory of 832	1060	cmd.exe	123
PID 832 wrote to memory of 4440	832	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe
"C:\Users\Admin\AppData\Local\Temp\41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2132
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 568
        6⤵
        Program crash
        
        PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 552
        7⤵
        Program crash
        
        PID:4864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 152
        6⤵
        Program crash
        
        PID:368
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 592
        5⤵
        Program crash
        
        PID:3152
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2176
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 136
      4⤵
      Program crash
      PID:3184
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4769.tmp\476A.tmp\476B.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe774346f8,0x7ffe77434708,0x7ffe77434718
        5⤵
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        
        PID:3432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
        5⤵
        
        PID:868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5512 /prefetch:8
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
        5⤵
        
        PID:904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
        5⤵
        
        PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8968955020085673568,8488566114052611580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1320 /prefetch:2
        5⤵
        
        PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x70,0x16c,0x7ffe774346f8,0x7ffe77434708,0x7ffe77434718
        5⤵
        
        PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4773152641618116549,9868372178909514009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4773152641618116549,9868372178909514009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:1348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe774346f8,0x7ffe77434708,0x7ffe77434718
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9119213488434023393,11572950650591213736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:3936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,9119213488434023393,11572950650591213736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2132 -ip 2132
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4508 -ip 4508
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4496 -ip 4496
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3884 -ip 3884
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4288 -ip 4288
1⤵
PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10242160-831b-4e01-b907-7ca8a8e71ddd.tmp

Filesize
6KB

MD5
21df1da7ea22957b8b9f15220b8db555

SHA1
b1948940bb592c57e6bdb733e2a0f24352b66e08

SHA256
d4d11188bf701e9e60afce4bf63481ccd3f27b7ce45275994519b7654f4f0094

SHA512
0edbd88a588771ab0ddea6e1cd0210db67f10f0fe4c1793d329d3f9603ab3e74032fce1a749b09b62554ca0952ae5e93346d6728086a2c66e8e189a067283f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3e72cb769f6cc768eaccd8040ed6e876

SHA1
2de43273463f07c4b2fd7910f8338a86aed63c0f

SHA256
817a1432af89d89a65c50df435a4c243235e14df16985eb8e5c9684185ee8c4e

SHA512
10e62d98e7cd704f9321f6ed937158bdac98f66f41dfbfd5c57be8eb4a2ef667ea91c5facafeab85710f29f93f413d6e977070ebe75974d202f90b0e379736ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
42e8f176d15095148467bda0f60f989b

SHA1
1c62d6974c6801db10741ff46a469b9a67679034

SHA256
f253a802ae936fa550890dafd5ec1872f558868090ce2223046abb4fdb6b9b78

SHA512
fe8bef8a401d19b31d55c89fa18daaab9dc6846c80f07ed124b2ce4558c7e36609953611cec60f6725e8115b19f1eb07194f12410d09cc8f80c37d217b0557ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
98f20a504d53d8407e36346b031c43c7

SHA1
849e9877b42575fa11f1d6114e040806ca119ec5

SHA256
1c2686d3608ce9320af86bffeed8493edde6a3d0f0ff077286619e061c86c08b

SHA512
d31f40979402a3910fde31fdb52ae0a46ee21cc0bf6f39c5c2f2e524b5e335e0ed70f441b254578389cc89e8ffe3704de85cd66d0bc5ec50db08be405cc1deec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4dd348a2d680a450e04f3904db05990f

SHA1
a42307ff6da020e85dbae2c2482e3f048d72011a

SHA256
ee260f8e7a4a0ae64261c33a1a22d5c47d8449b4feeefc13250ba45f99422029

SHA512
14dce1f955a8173e82433dbabef8e03c0b357bf35d3391023606d8494a8268716d902e9a49b7aea921506ad84ff635c77822e47d89514b927fa6c8f7ab67c7fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9057f80d69370ac9df9e56e7b14d5778

SHA1
ffa751d761610270afd311563d4bcec0e0346120

SHA256
c3215e74a0ef87731bc5eee6276c8d4cb73461a83e763c9fc771a85e2f756dd1

SHA512
bfd5b61129b45950679f52eb8244283575daa31d6d29322696efcca8ff4f006fdef92b814b1b03a11b3b973f1872fbfcb8b69d524a30f68a4d261b255d809e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
2cb080ceb78f8d88f29d33071a9f6921

SHA1
aa3c1afdf513df47ecb64a3686277d0952f9c49b

SHA256
b1a07ab76159a5a2692699664c46c232b18405a0fa53b58760ba17c7394e2446

SHA512
67c0b26009f225c4d5cd892da9c56c91aa283483877dfce7bfdb0b18f7a68914f6471dfed69a51d614ac6bc6b998982da8c6432bfeeda064b5613eaf54ce1e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3fa440d890550787b1bdd9321b0d172a

SHA1
a778907c2892c7f361131ec47285c4fef292f9dc

SHA256
140cf6374de3f9f27537facf254fd1ef139ee414c731ed4b796979e9c98c345e

SHA512
07143c521fdba1cf7092cfa596ca969a3d4d474bd0f18e0cf948c8c65d3a571775ca9bc110841dfc62b1ed429e86ba2f49d06aa380f5c90f11038eb35f6d44e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3a202403bb71e554c7e17cc93bcd9d89

SHA1
74d22d27f3f6302119e94211b920a9128867fee9

SHA256
d2732e71d1244e19daefe16b7f20beda4170cefdaeac037c4c3eab9c4812e069

SHA512
3f50ac9feef8837e42a149e1c72a9261b6375c982290b0348aa4ff2332d6771c0ea336f49faea4c05048ea9ee0fe422f784eb75534d48d20157cfdf3c59f5555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ae12.TMP

Filesize
48B

MD5
381a8d1646852bcf669b0c746c106890

SHA1
907743dd14377c4c6acb2b67a8c00e5685f641c1

SHA256
472bebd702dcad4717c69051b35d1ffb9eca79feb7a50ac1bdb984154c9b1939

SHA512
ca121e296060a53b7bf420bbd71b742ff4e0a94948928baeae4811be071772a8d38ef36be554568fed1c266992eeddaeba6ef53c4fc6248e1e9f8e504bc765f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4bfc334ae1dad68f2845d4e458f5e418

SHA1
ee0fa11e63fdc449761fea8551923125d1428a99

SHA256
637d19864fc2841ed0380dcea3e6da9024dd615ac06f2447301471efd566a3a2

SHA512
e16fe4ee5d2df76a186ca04b109879b05b775d383eda80f19213348c1fb32c856b57f606f03e687128f451c311ec85b34ff5b84cbd122ecb2ee4d481de49aebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a3641a8777b85ba92ee6e3fdd7d88e9

SHA1
b3fd2aca50a0096ae38d370180f5772f6412602d

SHA256
d3aebbf1db1cbd17d1ab13fc11f049b8b64b8ca25b7f5667ac891bbb8f89666f

SHA512
109dbcb2aa420a0c79ced0a95ae5f3240b6c3b648b357f170109bfc3cfa8f2773382c13f63171048f93bfd8aac4a31e3fa9f04761ad3949ab7c58be028d6e16c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9dc07c91c7f21fb914c6d58201a99598

SHA1
bf65914ef15704bfd3150b0fdd994c7a87548f65

SHA256
42fbb5741e7b8f18292554fca7853558fb0e2f2c7629b431a11ef3e3c9f46b80

SHA512
760d548e31aeb914058477e4dba7ae7b7f7556753c552de0b7d22aa0a99fca8a5a17dfcbca86fee8b4e9e57ee8df3d1bbf1d0d64ab65b249fd308d24d17e764b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
489feacf4693eeadb31f0df676340a6b

SHA1
4bb65130c5277ce97070f94371566b060806e5f2

SHA256
686ca1a7098ba077afe31cc1357c135e288e6ceddeff3a5f60218f98ae1a27be

SHA512
2e0549ea7d58243e81629ce9cef93f23928d29f27a3f8ad010709e1daaa99345ef15bbe523c7f1114148a78be5cc74d7de2add12f4fb6f72d795fb820b667b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57add4.TMP

Filesize
1KB

MD5
de102310f86f1ab369d5201d52385a7c

SHA1
b450264aa3b6a47c1a070bb9ffa75ea6ce59f249

SHA256
133e9893fd2874306a1d001484b24867aa981c4f0a21955ff5996f99a19b171f

SHA512
596cf9a97b0ea828f7085bb1eb5862b92094c3b9d89edcfee810c9984910ec77bdd2bc74232be52a6b1a12012aae15ed30570266c7a91d3986cb73ac1b1381a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4127674e1bea0018a7be6301ec4be79a

SHA1
d7c6ad574237ee726127c7a11f994204cd802397

SHA256
cfbac5e54eb88463babe022de432a7466a4c52c2a278b395775e011f5f3cf126

SHA512
794cbe2ef695d2706b4f1dd011be5f0df87157d909ffe73e90263122bf1bc084fb0cc8f356b4d3a9e572a52cd1251b47ff9322c33cb3ccf55165fe5bc2e053b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f2c6d27ec5a052184ed2fa60272809b0

SHA1
6072880ba14576a0238699ca06f94adfd627350a

SHA256
1e8a5b3f18d3a8aadf81408d956d7b49dabc2c209dc1a1abb7360675508c7e04

SHA512
f22814b37e2e2339523311fdf2bf5e08b9478ed0a84da8ec2c1ef5e0a4ef69c217a162944b49e2b99aeecb6db9949361e575674a1f5c39616efd5903154cc4c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bda24a19b4c697f372b04fe06cca4cf3

SHA1
f10e5780870d4a86355dadab0e5795baeb06009d

SHA256
0dd2e21d5f478da0a72482dcb2637054c39869fff4057a7489dd8dac7f01210e

SHA512
ae1a7c190ea0f1b0b368613c67bac2e3a684760a8add7ecbe394363ef52c1b1da4e4296128ef08764fcbe7632f692e5fcdabd6d81fe1626516291e067b3ee4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4769.tmp\476A.tmp\476B.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe

Filesize
87KB

MD5
949cbec3b3037780fbcf68b41a82fe60

SHA1
2f836ee237ffb57daf8d5dfff0461a1d65b4b672

SHA256
36cbd02759f14d89ab98129f5568effa2e7d10b7b9ceb8f174e4aaafd8fbc8c3

SHA512
facf34694cc2dad67b73cc7f6ba854deba1356c121f84490bc00106f349814418650522e49e3b4a9ddcee4ac6a4c06b453028ccf9dce65921a04d421c34c923e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe

Filesize
742KB

MD5
1c72cf4e68143e9563b613c8948873fc

SHA1
ec5ed7fd64b5b2849317f8c9014bfb706db860d7

SHA256
b7e5e3d078bcea0202418040de2234147d9f30ad195320677f36fa09ce6e8829

SHA512
0fc3209463dada372dc2f91473848d56371f1877b92543dd4b0d92d05d419d57e5f33fd24eed8462338303852647c25dd825edd36a1feb14897998bd0d530251

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe

Filesize
336KB

MD5
cc40d1fd09946625e7b9a8b39115e019

SHA1
48487fed757a58e76c7bf8948a1e5114de85cd2c

SHA256
3bdd4e656c4cf13ca8ecde337887d6ff65566b117dfc37413ac9b412be60a17c

SHA512
48dad8fe2f06c50aa49e5b8c483b2a955f81a6599b0b1281fb29a4bbc1690a8d4c1c78320dbac36c9550afbcc288d043370c6045d51ac77b8cb4e0e437a65bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe

Filesize
508KB

MD5
522091f101a94de136e66d69be30e14f

SHA1
e087bc9561aea26fc0612d2c02540692cb51d312

SHA256
36c8c1bd5a2a065ca10b6ec7db47fafec37aae4cec85a358905be8177588fe43

SHA512
65516d8d40c419d08014d68828010e53278ad8442db6d3090fd33946b5869de00b933fa2c9f155031b303cf0008c07506bc03fe60b70918633d059a15223b8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe

Filesize
145KB

MD5
ce3b6a20db18d730a3706a0d4c9e3a67

SHA1
200fff6de835d17f8e240b16226d7e79f1c58eab

SHA256
8f9e23a3acbad41d00e4521368b32db5a801611914f2217088bbe2ee379e3775

SHA512
533e2604545d2a0a6d8f69f83b1c06400416c3618b5ce68050c96c4384ead04558594958a1128d67ed6683585528a8b67f418f7efc0d583568bf2f547bfab2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe

Filesize
324KB

MD5
597c5108f287f50f7c2cdc8c9b4ee0b9

SHA1
9840c5ec7759f9d39832183a196828df83665c97

SHA256
a8ac4275228bdbd18e96161c17aa38551f4748db6ff650997fc5c44095ec608b

SHA512
4d9e41761bc272030001f8176546683b66e444ea24d4ec2f807ef07ff039409769d270eb042a647348d4bd1149f25e0870ba2c4f002d4861f7ab483af308eade

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe

Filesize
295KB

MD5
e5b62ebfb765fb5276bd60ac1160cf42

SHA1
2ae5b0b91d341d092180314b7c6bfa5c53e367b7

SHA256
c70ba80942dad9cddb5fa849b84f3d38fe1b5426dca1e0329d491cb4367f55c6

SHA512
5ac3fc6c3f874a84660d373fe1c89f922daaf43eeb794ec2d6998c0823ce81f8c5ec802392b48a715c27bb737c23edf0c4311f6e4f93bcbc7ab577df943d8af3

Download Submit
memory/2220-343-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2220-59-0x00000000076D0000-0x000000000770C000-memory.dmp

Filesize
240KB

Download
memory/2220-56-0x00000000084C0000-0x0000000008AD8000-memory.dmp

Filesize
6.1MB

Download
memory/2220-58-0x0000000007560000-0x0000000007572000-memory.dmp

Filesize
72KB

Download
memory/2220-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2220-47-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2220-50-0x0000000007400000-0x0000000007410000-memory.dmp

Filesize
64KB

Download
memory/2220-54-0x0000000002760000-0x000000000276A000-memory.dmp

Filesize
40KB

Download
memory/2220-61-0x0000000007710000-0x000000000775C000-memory.dmp

Filesize
304KB

Download
memory/2220-49-0x0000000007420000-0x00000000074B2000-memory.dmp

Filesize
584KB

Download
memory/2220-57-0x00000000077E0000-0x00000000078EA000-memory.dmp

Filesize
1.0MB

Download
memory/2220-48-0x00000000078F0000-0x0000000007E94000-memory.dmp

Filesize
5.6MB

Download
memory/2220-344-0x0000000007400000-0x0000000007410000-memory.dmp

Filesize
64KB

Download
memory/3484-200-0x0000000002DB0000-0x0000000002DC6000-memory.dmp

Filesize
88KB

Download
memory/3928-306-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-29-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4496-34-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4496-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4496-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4496-33-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5088-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5088-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5088-201-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download