mystic | db697782cf909776181ac61571c8cea7b322a8516dcf2362080fe0587c0c8439

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe
Size

877KB
MD5

eca05379305a79927fa28d92dfae17e4
SHA1

04dd6087a27ae3c952e37f7e3376d1684c4d89c2
SHA256

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f
SHA512

399cc8ae6be5a08ada89a58409e5c5e97a6e936d140279066b90133ca0cdb3efbf36f90f2c480abcdc3849471ce56de4fa35c22f94bc7fc3923143dfd800b644
SSDEEP

12288:mMrRy90OZS8MmmyqQaai0wpNTcHMPAqUA/im7He4aHKOC1AzOIwV:vyb/myDaaRecsoqFimDe5Hsy8V

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4036-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4036-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4036-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4036-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4872-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5ci6Cm7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	5ci6Cm7.exe

Executes dropped EXE 8 IoCs

Processes:

sn9jA91.exegg0Mr52.exeSN8Us39.exe1dK35Zk7.exe2Jp0041.exe3Fp53jU.exe4wJ775Kj.exe5ci6Cm7.exe

pid process

1372 sn9jA91.exe
4060 gg0Mr52.exe
4212 SN8Us39.exe
1492 1dK35Zk7.exe
3452 2Jp0041.exe
4764 3Fp53jU.exe
4856 4wJ775Kj.exe
2980 5ci6Cm7.exe

pid	process
1372	sn9jA91.exe
4060	gg0Mr52.exe
4212	SN8Us39.exe
1492	1dK35Zk7.exe
3452	2Jp0041.exe
4764	3Fp53jU.exe
4856	4wJ775Kj.exe
2980	5ci6Cm7.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exesn9jA91.exegg0Mr52.exeSN8Us39.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sn9jA91.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	gg0Mr52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	SN8Us39.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1dK35Zk7.exe2Jp0041.exe3Fp53jU.exe4wJ775Kj.exe

description	pid	process	target process
PID 1492 set thread context of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 3452 set thread context of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 4764 set thread context of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4856 set thread context of 4872	4856	4wJ775Kj.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3584	1492	WerFault.exe	1dK35Zk7.exe
3612	3452	WerFault.exe	2Jp0041.exe
4772	4036	WerFault.exe	AppLaunch.exe
2796	4764	WerFault.exe	3Fp53jU.exe
1848	4856	WerFault.exe	4wJ775Kj.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeAppLaunch.exe

pid	process
2908	AppLaunch.exe
2908	AppLaunch.exe
4864	AppLaunch.exe
4864	AppLaunch.exe
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528
3528

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

4864 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe

pid	process
4864	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2908	AppLaunch.exe
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528
Token: SeShutdownPrivilege	3528
Token: SeCreatePagefilePrivilege	3528

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exesn9jA91.exegg0Mr52.exeSN8Us39.exe1dK35Zk7.exe2Jp0041.exe3Fp53jU.exe4wJ775Kj.exe5ci6Cm7.exe

description	pid	process	target process
PID 1780 wrote to memory of 1372	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	sn9jA91.exe
PID 1780 wrote to memory of 1372	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	sn9jA91.exe
PID 1780 wrote to memory of 1372	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	sn9jA91.exe
PID 1372 wrote to memory of 4060	1372	sn9jA91.exe	gg0Mr52.exe
PID 1372 wrote to memory of 4060	1372	sn9jA91.exe	gg0Mr52.exe
PID 1372 wrote to memory of 4060	1372	sn9jA91.exe	gg0Mr52.exe
PID 4060 wrote to memory of 4212	4060	gg0Mr52.exe	SN8Us39.exe
PID 4060 wrote to memory of 4212	4060	gg0Mr52.exe	SN8Us39.exe
PID 4060 wrote to memory of 4212	4060	gg0Mr52.exe	SN8Us39.exe
PID 4212 wrote to memory of 1492	4212	SN8Us39.exe	1dK35Zk7.exe
PID 4212 wrote to memory of 1492	4212	SN8Us39.exe	1dK35Zk7.exe
PID 4212 wrote to memory of 1492	4212	SN8Us39.exe	1dK35Zk7.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 1492 wrote to memory of 2908	1492	1dK35Zk7.exe	AppLaunch.exe
PID 4212 wrote to memory of 3452	4212	SN8Us39.exe	2Jp0041.exe
PID 4212 wrote to memory of 3452	4212	SN8Us39.exe	2Jp0041.exe
PID 4212 wrote to memory of 3452	4212	SN8Us39.exe	2Jp0041.exe
PID 3452 wrote to memory of 3496	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 3496	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 3496	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 3452 wrote to memory of 4036	3452	2Jp0041.exe	AppLaunch.exe
PID 4060 wrote to memory of 4764	4060	gg0Mr52.exe	3Fp53jU.exe
PID 4060 wrote to memory of 4764	4060	gg0Mr52.exe	3Fp53jU.exe
PID 4060 wrote to memory of 4764	4060	gg0Mr52.exe	3Fp53jU.exe
PID 4764 wrote to memory of 2320	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 2320	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 2320	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 4764 wrote to memory of 4864	4764	3Fp53jU.exe	AppLaunch.exe
PID 1372 wrote to memory of 4856	1372	sn9jA91.exe	4wJ775Kj.exe
PID 1372 wrote to memory of 4856	1372	sn9jA91.exe	4wJ775Kj.exe
PID 1372 wrote to memory of 4856	1372	sn9jA91.exe	4wJ775Kj.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 4856 wrote to memory of 4872	4856	4wJ775Kj.exe	AppLaunch.exe
PID 1780 wrote to memory of 2980	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	5ci6Cm7.exe
PID 1780 wrote to memory of 2980	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	5ci6Cm7.exe
PID 1780 wrote to memory of 2980	1780	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	5ci6Cm7.exe
PID 2980 wrote to memory of 4840	2980	5ci6Cm7.exe	cmd.exe
PID 2980 wrote to memory of 4840	2980	5ci6Cm7.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe
"C:\Users\Admin\AppData\Local\Temp\df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1492
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 552
        6⤵
        Program crash
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3452
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3496
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 540
        7⤵
        Program crash
        
        PID:4772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 148
        6⤵
        Program crash
        
        PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2320
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 140
        5⤵
        Program crash
        
        PID:2796
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 216
      4⤵
      Program crash
      PID:1848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BAA5.tmp\BAA6.tmp\BAA7.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe"
    3⤵
    PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:2764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffd491746f8,0x7ffd49174708,0x7ffd49174718
        5⤵
        
        PID:4888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,14364462060539689219,15831407447183480771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
        5⤵
        
        PID:3872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,14364462060539689219,15831407447183480771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
        5⤵
        
        PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffd491746f8,0x7ffd49174708,0x7ffd49174718
        5⤵
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
        5⤵
        
        PID:828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        
        PID:3184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2432 /prefetch:8
        5⤵
        
        PID:2336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:1340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
        5⤵
        
        PID:1928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4224 /prefetch:8
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        
        PID:4660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
        5⤵
        
        PID:2964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
        5⤵
        
        PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,6671262848351250068,17587846798669881441,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2
        5⤵
        
        PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x48,0x170,0x7ffd491746f8,0x7ffd49174708,0x7ffd49174718
        5⤵
        
        PID:3928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4059097996200555350,12513632124166948741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        
        PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1492 -ip 1492
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3452 -ip 3452
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4036 -ip 4036
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4764 -ip 4764
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4856 -ip 4856
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0bd5c93de6441cd85df33f5858ead08c

SHA1
c9e9a6c225ae958d5725537fac596b4d89ccb621

SHA256
6e881c02306f0b1f4d926f77b32c57d4ba98db35a573562a017ae9e357fcb2d2

SHA512
19073981f96ba488d87665cfa7ffc126b1b577865f36a53233f15d2773eabe5200a2a64874a3b180913ef95efdece3954169bdcb4232ee793670b100109f6ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
02ed9406517e636a8968b48ce67dca32

SHA1
204ab9d922ad36c0000ca9a8b2625a3f13d795c1

SHA256
d18a819f50def5a8c0083d5dd9406ffb7f4a85c05f12fd58a9786bef0b96b4f7

SHA512
c385dd4c8ead0f4856ed2fa316a59397ef62c763d55dda6b2bb5039c3878e3e2e2122c1080d67876e62c30f11191d0d1ebc9c3e9ed2c4ef4a15b251f0836e89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4272141302a37a8b58528a02f0ac5d9a

SHA1
2cab67997752ad413cf75f943953e7a2d2d1b25f

SHA256
3cde04fccfc727afb58e9af90b40d279151f786c75b56be36235b8c0cf670f19

SHA512
b8a40e21abb332d85d8bfdccadc2f7ad7cb0849857d878737e48b3e368a302d76f3b43f4c51ea82c86472058311148bb1c5092f679265ca1685f46998a76b327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e93e623bf81d621aae6fcf13ea5c1702

SHA1
a8ec3ea0e686e6ccb13e41617a14a52b74771d71

SHA256
3235bf6fdbf9fdea5859203445ed89fa15d8b0ce03d21e5467baf7a9d6b9df10

SHA512
a0004ddcbe94db26555734d04145ca9399ffb2c44c2e2e5e44d9689697ad311e15ea7ac9265314ec4ed5653dd5dc2152a96f3a82c06d70b87b5222eaf5e353d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ac992183bf8e89fde23d86ee266eefe

SHA1
90549071faa527b8a557507aff4885f1fd49c29e

SHA256
d767a01c25dc7b57812f69df784168911fb43b15010ae631f4ae0a2cc3d87738

SHA512
89e0f65d9c6d423984d8354730c64fbd69a5ef49dd0c98be1f7480c7f150a7ce92e9d86915f52f41edfb83e649125c0721231e5ba3fc481ff64c0e34ae188b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
afbe2e7ef0ad3dd9fec203e8c703c423

SHA1
bd837a7dc1f73507e9be545675d7a448f5c40bc5

SHA256
2eeb8542b232114cb6d6ff1e82848b9e00df1bf44dbaaac49747cd5731085585

SHA512
c9b91f0fbcd08890325ad207740771be3acc6e4a2cd8e8938f9ee606a2bbb255e7a9c43135be7208761c1a89d8d023567a5b98c91043543cb21837245bd36e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
e7522fa382a27fb1c5dc89968d920396

SHA1
3fcdf6d1adea411e4a212aea431d5c4a7f2bdde3

SHA256
638b1a895ae90a00fa6396a88118a174386213fb57048c70a5436920cd991176

SHA512
696eb93a82c53eb07d20220f35ffaf3556c15b45fa25071cffe08c18d68b570fdb399b2a4cf4f73e4f5112fbb69ab6130a8d5a26cbefa6ef9e48322ad9e0c19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
34764c1897acded0b464bc0a12dd657f

SHA1
0e615c1bac499a2f262440f05ef385376f3685df

SHA256
909b4206e69d508e12ffbaa2816ba1eddd9dc24bbe02025412a0392e7fd89647

SHA512
ff2277fe3d1b41878e15e33afeaa2f2100ba060efe48d00a75feaa5f35e7f98e52e79baf54900967626a665a7999e578b60475ed03329c1a846ac3178fa0f399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dac0b5a82d6640750ece63eed4015003

SHA1
7a726519b3986208857528b040166601f415b20c

SHA256
1d88a99d43f0287063ff63f7d9e179440109c24bf20cdbbf547452d770ebfd89

SHA512
566d2d282cec368b62a2321a25bd6b0d6f0d533ada967f7d1c6e1e5b7bac378aee520586cd419cffac67e1833dab9a5d776175c7cb7b33bc4b3411455c4ab5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582b03.TMP

Filesize
48B

MD5
587d161154043d49705b8c7970ab6a86

SHA1
9013e0b3941af71ad9bc8b2e71079d78b0b9e5fe

SHA256
1bf3d9264b895587e5421c25ebe450ce345d5757ff0c361c4e85f44091a8c82e

SHA512
b8816f943ed02556a487b7053a9fd8d609bace7ccef808390a260f017f7efa1c377e2436d534c53c33ab528687505bc64679be753c3e6abdd62c55227b8e0bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0f8e7ac0b0c9a30306517ccc80ee7177

SHA1
0539217a073a76cb781570563f7fdf8c28a73cc8

SHA256
19fab106ded4decde916a44cc4e30ac296437d1cb884e7f4a22966156afb0321

SHA512
a2aa893e5787034b0b3b476a91afe108f02ff1f62ea7b032e32e8e43348088cb3c5c7d66ebe96ab2582912fe750df19b5bfb2f78d793cd17400b4128cd9756d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a145b6beaec6625a525d4bfab65b3f4

SHA1
35da563db3a82e97e6c9c13a5d58404d5f2d05f5

SHA256
902282b9161c1d3076704fd881025a55498b70ec3256985461810012d0cf11bb

SHA512
9eb50a584daf31ad7b61e6eabf3f7cc70488d29a3032d4ba7ddbffb027d40f141ff7df1fe7e42ff38252518d20939f7e2ad9de819a64efa1989571128c682231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ba847714fdac63f331930ec214e91a3f

SHA1
a3120f966ca9d4e850b3db8e96386598783b9b3b

SHA256
5ad077d1b7fa8b944e39689214145f61aefc96aa4964953c74e822fb3394c978

SHA512
b442ac40c1824997f870d06f1f88eee11b90ade2bc39ea32490293351b1f8ad6e8580a9163609aed1213c6acc9e9fdbfbe6d449be4f4261974ade596c905c118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5826fb.TMP

Filesize
1KB

MD5
cfed8fdae392ee669bc5ac9b256f5828

SHA1
0f4c60edc8e6ca63562618f843c186503cb6b6ac

SHA256
f844601a02fbc7309e67712ebfd0a490da0cf338a397830a970d6a6e50d72332

SHA512
23ae352518e924b50f3625866a0783de6c40e90e2f37ab59462cb63a0d18819f84e023f6f903ae5928f7ad38fe13829a4998ce0f58fa9aa23e635ddfe29eadc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
2a8762f00147ff82092ac9ceddb42346

SHA1
8d51b797d22822bc9aac2a94e887dc888fc60608

SHA256
3d7ecd9b6704cb73a4d5e0a9986c3ab779e9c24904ef6debd6b1e2227639b735

SHA512
97a58eea8de3ed42ef8819684783b99ce107a5659612a701773adec6a7f5779e5bed174690197c383e112e03f36adaf6bb6a034e6e102d40f67632e81db8e9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b4c218943530489dbcce0d8c0121733

SHA1
a55d592415ec9841d4d026038a3ab47a311e5dee

SHA256
e797faaa2f6a8eda9cf49dab60c5206301bead0638b49b52d12a0c2ad629fdb4

SHA512
4b0d751e1b6d4d6aa98cc37dc48ef1f8bbb9dc652ddc57c0ec4d482645400ffe06e674d990f07b863e00f2ce7136e73febc548f85f5b12a5018cab5db2df36b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
de554aaa81cfe2edc481208b54302b6e

SHA1
551f311b3731f69748255c595834751f88cfc3de

SHA256
7f94446d77022009bc7943648fae43d124c5dbfe71f1aff036f710e54a32f43a

SHA512
33f3d8acc2a7c334f6577aaa698d4a7f8634881dba94a47ed020bbaa8067a4b3c71cff3d6fda0f70446d230de754253fb64ad657d51693de656250550d0edc42

Download Submit
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp\BAA6.tmp\BAA7.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe

Filesize
87KB

MD5
de41e19902722935666e4b3d439d279e

SHA1
232f42e8719cf44634f124b3e4b3534a1731754b

SHA256
0d2b2c2d4f3c9b14ca227d51e135d6c5d6a4f014ad7d9401d629c72daeef46f0

SHA512
4d97745f2478aeb74265ff43528702a591f6f88ef6eeca279ad0cbc142319636738986516bb7415f5e4e61e169236c138cf97feb12e850787f2ba0fd89c5b966

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe

Filesize
738KB

MD5
c64805e6684b4a1ed2df2aa7369d4570

SHA1
be7ef85f78ebf9bc6e24a869f22b9c8d88a8fddf

SHA256
07af005f82050105cbaa7685ded57dc50777c768bf1df74f614259573d724e38

SHA512
d2cc179385015dadf0ffae450ea63bac8b81f51c2f31f35a7b4af00772ad50833efbc3c8e1f2788f7ac373d60bc6455adad5546cfc746bcdb5593be03e82883b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe

Filesize
339KB

MD5
33857b25f956d49ea42cdb19e52e9752

SHA1
7ca36bf415b33ab61012fef50cc4f2588e57eb0f

SHA256
f9a190b8e5a02d43a970a1dbe631f6edcbe3ddb9c4ea163f0eecd1a895e7cfaa

SHA512
ba03125ff5293edad2ba1416ebe0fbe329cd1e7bbf5383423600e8f30cd70111a2ff453e2dc0e5c4e539c1a18aa165eb457660c27c37003fd0a129662fcdc300

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe

Filesize
503KB

MD5
8a41a1de42f0c015f8f51b69fcb28e17

SHA1
e55f6a67e1d0a21fc7b529dbf1e114bdc0002721

SHA256
29ac9b30938f4062db2b9930635d9a23cbf9579dc808ba044c797b4df720ad5e

SHA512
cc98eb44055796705beb7faf895ee5a1e0a936da3c49f080c5a3a6afe1a00587954814b8628cb764105c1d52850b056925d34cf9f7ba37ecf15775b1f273e998

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe

Filesize
148KB

MD5
6e20e6b39b2b0a22dd877fa3b813317c

SHA1
15310a1ed0e2a8b9442977ca4b2e1d3a30dbf733

SHA256
ad0135a8ad03cc13ca8cf2d785ebce7ec7f2331f1053846e7ea4479ec30a97b2

SHA512
ce7d26868eee5b7ed1e3c404427ae7600e48882b73a140a80f5eef03738c1bfe9f7973ba2e8625454aa7fc37824eb22dda4b97da3013dc1a5865a3d7e54e4c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe

Filesize
317KB

MD5
8b8e285daa79c4b98940904118efd88b

SHA1
c5c840c0fd05b59109788b7efda949644ca5c60d

SHA256
becc1f830480e1c2719fdfef9e8b29299bcd4e380188a6c8434b4102f00dd98c

SHA512
7a184475de1667e64265411897c1e8873071b4ca97ff3e0b0505e7c9bddb40b2427e5d251b3d3e9ffb0fed924b28ba5f9bb7c159b3644e99ef4caa51d4a3948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe

Filesize
298KB

MD5
4a071cc30292b81eb2350b5027cfde8f

SHA1
55825da08668fd0a1e197b75e6e42c7bbd99694f

SHA256
474f604ad90cb29cce321f4977f03a8144e99d8419e351de97e981e0db76d0a3

SHA512
2ab61f576810172f7671e7ed16c0f08e9802f16df843d543cf6ef600372ac715888b2822837766d8af8f61b7854acbef9d41b828500eb9d62184c496dc21e78a

Download Submit
\??\pipe\LOCAL\crashpad_2764_ARLNNGYXMJIUUWAV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2908-34-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download
memory/2908-29-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download
memory/2908-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3528-48-0x0000000002960000-0x0000000002976000-memory.dmp

Filesize
88KB

Download
memory/4036-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4036-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4036-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4036-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4864-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4864-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4864-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4872-377-0x00000000079D0000-0x00000000079E0000-memory.dmp

Filesize
64KB

Download
memory/4872-65-0x0000000007B10000-0x0000000007C1A000-memory.dmp

Filesize
1.0MB

Download
memory/4872-64-0x0000000008830000-0x0000000008E48000-memory.dmp

Filesize
6.1MB

Download
memory/4872-376-0x0000000074230000-0x00000000749E0000-memory.dmp

Filesize
7.7MB

Download
memory/4872-68-0x0000000008210000-0x000000000825C000-memory.dmp

Filesize
304KB

Download
memory/4872-62-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/4872-61-0x00000000079D0000-0x00000000079E0000-memory.dmp

Filesize
64KB

Download
memory/4872-56-0x00000000077A0000-0x0000000007832000-memory.dmp

Filesize
584KB

Download
memory/4872-55-0x0000000007C60000-0x0000000008204000-memory.dmp

Filesize
5.6MB

Download
memory/4872-54-0x0000000074230000-0x00000000749E0000-memory.dmp

Filesize
7.7MB

Download
memory/4872-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-66-0x0000000007A40000-0x0000000007A52000-memory.dmp

Filesize
72KB

Download
memory/4872-67-0x0000000007AA0000-0x0000000007ADC000-memory.dmp

Filesize
240KB

Download