mystic | cca6e4355cfdbbd8cbbb95338cbd8fdd72b6bb105b6468e366b69eba4a761b98

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe
Size

878KB
MD5

d318c6337d7cad78817bd3b9b3f43bc5
SHA1

dbf134d1a4d1d712bd4d917bba0c2545fb5f901d
SHA256

b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2
SHA512

4b3f8c606d1f33c823c3fa74f560208d951d4591a1fb894de6919eb809ce167fe0e5498eb89c3f3ef4c231580bad8ec5d7bc4bd2f1d0974bcd9571b4bac4a4b0
SSDEEP

12288:KMr0y90qyaqD7Ok06pNmgoVKDrk4qKdFagXt0ogWtTlY3tXrGlqFfmef2mglg+x2:GyCdce3DrkaTRgAitbGUR2maXIJp

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3408-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3408-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3408-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3408-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4296-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	5wf6ml2.exe

Executes dropped EXE 8 IoCs

pid	Process
3496	LN1mO30.exe
724	Ab6Sl08.exe
3352	Yv8bp87.exe
2352	1El11lU6.exe
3908	2WV5607.exe
2636	3du32Ol.exe
3628	4Qi486Yp.exe
3712	5wf6ml2.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	LN1mO30.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ab6Sl08.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Yv8bp87.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 2132	2352	1El11lU6.exe	95
PID 3908 set thread context of 3408	3908	2WV5607.exe	105
PID 2636 set thread context of 5000	2636	3du32Ol.exe	112
PID 3628 set thread context of 4296	3628	4Qi486Yp.exe	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3584	2352	WerFault.exe	92
2012	3408	WerFault.exe
4636	3908	WerFault.exe	99
2032	2636	WerFault.exe	110
3912	3628	WerFault.exe	115

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2132	AppLaunch.exe
2132	AppLaunch.exe
5000	AppLaunch.exe
5000	AppLaunch.exe
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found
3544	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5000	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	AppLaunch.exe
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found
Token: SeShutdownPrivilege	3544	Process not Found
Token: SeCreatePagefilePrivilege	3544	Process not Found

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3544	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3496	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	88
PID 912 wrote to memory of 3496	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	88
PID 912 wrote to memory of 3496	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	88
PID 3496 wrote to memory of 724	3496	LN1mO30.exe	89
PID 3496 wrote to memory of 724	3496	LN1mO30.exe	89
PID 3496 wrote to memory of 724	3496	LN1mO30.exe	89
PID 724 wrote to memory of 3352	724	Ab6Sl08.exe	90
PID 724 wrote to memory of 3352	724	Ab6Sl08.exe	90
PID 724 wrote to memory of 3352	724	Ab6Sl08.exe	90
PID 3352 wrote to memory of 2352	3352	Yv8bp87.exe	92
PID 3352 wrote to memory of 2352	3352	Yv8bp87.exe	92
PID 3352 wrote to memory of 2352	3352	Yv8bp87.exe	92
PID 2352 wrote to memory of 3284	2352	1El11lU6.exe	94
PID 2352 wrote to memory of 3284	2352	1El11lU6.exe	94
PID 2352 wrote to memory of 3284	2352	1El11lU6.exe	94
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 2352 wrote to memory of 2132	2352	1El11lU6.exe	95
PID 3352 wrote to memory of 3908	3352	Yv8bp87.exe	99
PID 3352 wrote to memory of 3908	3352	Yv8bp87.exe	99
PID 3352 wrote to memory of 3908	3352	Yv8bp87.exe	99
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 3908 wrote to memory of 3408	3908	2WV5607.exe	105
PID 724 wrote to memory of 2636	724	Ab6Sl08.exe	110
PID 724 wrote to memory of 2636	724	Ab6Sl08.exe	110
PID 724 wrote to memory of 2636	724	Ab6Sl08.exe	110
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 2636 wrote to memory of 5000	2636	3du32Ol.exe	112
PID 3496 wrote to memory of 3628	3496	LN1mO30.exe	115
PID 3496 wrote to memory of 3628	3496	LN1mO30.exe	115
PID 3496 wrote to memory of 3628	3496	LN1mO30.exe	115
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 3628 wrote to memory of 4296	3628	4Qi486Yp.exe	117
PID 912 wrote to memory of 3712	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	120
PID 912 wrote to memory of 3712	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	120
PID 912 wrote to memory of 3712	912	b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe	120
PID 3712 wrote to memory of 4428	3712	5wf6ml2.exe	140
PID 3712 wrote to memory of 4428	3712	5wf6ml2.exe	140
PID 4428 wrote to memory of 1040	4428	cmd.exe	124
PID 4428 wrote to memory of 1040	4428	cmd.exe	124
PID 1040 wrote to memory of 1228	1040	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe
"C:\Users\Admin\AppData\Local\Temp\b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LN1mO30.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LN1mO30.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ab6Sl08.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ab6Sl08.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Yv8bp87.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Yv8bp87.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1El11lU6.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1El11lU6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3284
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 588
        6⤵
        Program crash
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2WV5607.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2WV5607.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3908
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 540
        7⤵
        Program crash
        
        PID:2012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 152
        6⤵
        Program crash
        
        PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3du32Ol.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3du32Ol.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 140
        5⤵
        Program crash
        
        PID:2032
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Qi486Yp.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Qi486Yp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 136
      4⤵
      Program crash
      PID:3912
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5wf6ml2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5wf6ml2.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A086.tmp\A087.tmp\A088.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5wf6ml2.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x8c,0x170,0x7ffa7e9246f8,0x7ffa7e924708,0x7ffa7e924718
        5⤵
        
        PID:1228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        
        PID:4792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
        5⤵
        
        PID:4740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5404 /prefetch:8
        5⤵
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
        5⤵
        
        PID:5060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
        5⤵
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
        5⤵
        
        PID:4348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5911654840163261671,3085042647097765875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
        5⤵
        
        PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:2260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x140,0x16c,0x7ffa7e9246f8,0x7ffa7e924708,0x7ffa7e924718
        5⤵
        
        PID:3276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,9027402439825498486,14368016890680130807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,9027402439825498486,14368016890680130807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
        5⤵
        
        PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x78,0x170,0x7ffa7e9246f8,0x7ffa7e924708,0x7ffa7e924718
        5⤵
        
        PID:3260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3000831898238652172,5288383580530249400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
        5⤵
        
        PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2352 -ip 2352
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3908 -ip 3908
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3408 -ip 3408
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2636 -ip 2636
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3628 -ip 3628
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
462640400f2394f380a4c699ccc2e4e3

SHA1
fa7485486156456219dd2e40b933bca588dc023f

SHA256
518f143402e66be9614d2d370abbe6e2e1a2ef101a4a1a45316d22b6dde67df8

SHA512
7d6821c68cb3007b2defd16e35e620b905db3ecd2dea989d467028773fd0281fb8cedb8a59b9a60d84ab50f53f6ed9a886f30a4d2155a3e8621a8ace2fcfc0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d067b0af94e77521221b2717374786f8

SHA1
a1cda55ccfce322f2201c58d33b99ff77109358a

SHA256
55e12c2866f231f68dc5e41d05cde5eafe8bec902747add718d0d07f4852c2b4

SHA512
712f45a6759336146b76bba4b2812d9d5117f4798506baddd88675abdb90b0761fb5450478c7a05bef7f18ecb75090f5377678a6f0f0340a80109bb60cf1c99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
72abfb1d1eb8d35d23d163f9f9679fce

SHA1
2338eff86dcd6732a7459b8a6f4be704c506440d

SHA256
83a4bc1d7cf98399b5566e957ff1aa1910fb41391d11036b23c3cddb1dfb6d29

SHA512
1506687cfa3ea683f199e0f20eda6724a345c2823247337823496c8e01f87300175a535f1a8e5357992a6494ce708ffe7536b9447c621b5a06581a60db494bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e499ddc0f41cffc9c8a533f0ced99be

SHA1
00c6708bd3ec6c04722e4f291a25e5491b14a575

SHA256
85cb712a2ffe1ca98d3619b12714697c80012c4eb6d5f998c420061aa9c7e0ff

SHA512
34edaaf465ad512e811e798ed61e5314c06a803b9b34d8242a131777ab3e4aa7d296609529dff1939ef9d4f3429b413e5ce68067a0beb3991dc5a18e76756a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
14dfc122d3b5e430ac1632083048d028

SHA1
7d9b4f72a38236d604fa4049d2d748efec5aa008

SHA256
e87fb15d719917e45c58110e5dfce453dc5a560ea58a4d7e1607168f1857e926

SHA512
d448685f0355779e13e7ce2fe8bf72566c97b1cb5e06a0541564682a3af28bcd24e510349e68584014256ff921f97e9ce37ec5e6001662cf88d619cfd089be4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
85ed405bd9b5e9f5e13a1c404fe680e9

SHA1
89706dfc2edbbacf7d964fa8e4448eccc97be675

SHA256
00f33f37e8f04569520a3d561177b80fbe4f3ea8284c983fceab81cce4ef1b21

SHA512
4b234b414325f0520adf82fac46b9b4d9dde17834f0a42fc097d06f54c92a31fe6f9e94c3597b856ad970b40af6a706f7cfe5e6bbeb62d3e687605822efc8585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
682406c3d5b32a8ddea75ee392bbc30b

SHA1
f9ae173f0e1150f141ac99dff0854b7a8f38fdb8

SHA256
9104caa3111b9ea5fd89b80be7c72ce66919bb7179bd43ea706d786288ce5ebd

SHA512
47b6ea5607deb9b9059ef62c72203a45407b2f5d90ed84726a2cd74d2be89412718144a22641e1f1ebb9ea49a5b99ad989cf143a1e9c6ac081770b0a2404140f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
03dc5135a1260d90ca233119465f64f0

SHA1
ccf18e9e131c9dde6bb5c64015b969474d5ef909

SHA256
94de8ccf550c7dc0062edfd1ce89901846b8ef6e634b3db158270d1d6181d4cb

SHA512
fc06e55aa1fb651c88a7d80327eeb2cb9fc6f484fb5b0dc5ecb8f46130e9f972afaf0bc7aea6e52db161b24571e9544818bd7f59b0284ddf871c56c005e7c968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5807ac.TMP

Filesize
48B

MD5
e0a429eff64566244d8fba6a426bd025

SHA1
d92a2de53ec6c1d24f01e2b42817d0ca047cdab4

SHA256
dd677b1960c583cb4a8a87b2e684101d461f4bda630103dd512f7ef71057b0ac

SHA512
eba148fa525822a9305c8100c9e31fecc81bf1b6611473243d4f3dd36c068983f98fc98d08e743b22ac5012e1f5a6916eea7cd2517d881283065d4db3239c985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d768c6f89c8098b8287b5fa7f97e8574

SHA1
ba4a024509b359ed49d6e453913d8b96b37613d6

SHA256
8221397da4cf0764600603e5053216d49e3c1924b883bf20e6db10c4af017f8d

SHA512
3a1cdc89d62c5015c290ed5aa40b5f82e9809292d36a741afbc03626eaa09d7ea0c0dcf2272354b41448d737497fad085cbda4faa35f97fd56aa2843df246efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f05f9e264362cc6b3ae30102f45bb5c

SHA1
f3154984dbd3e3f37effbcb91b3ca77aa4af5eaa

SHA256
2965f4a08ffd7f626f1bf41c52becaf0c992dbdf17b550084333b0c959a95315

SHA512
eec7a9798f8a49251f4355389e0fba9f3608568f69f0c8f96b54f7ba0768ccbe50221e259c29547d56fe6acca4e1e942b803fc882a59ab2bd17b75f33911803d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8457315cc692b01aaac17a7da2b32b78

SHA1
17f72bb7eba5a9f0b58bf8fe1327b791e60dadad

SHA256
3c53538a26487836b2d3c1dfdfee5f27f12237e3b8bed1d275b0a17d1cf58cd3

SHA512
4297bd56f36e65f9d14c9c53703ce44ab319bca12f7c5b9f489d16ec14d749bbc0555693123312935a28fc541010797b0f5c195e6f6d82e10bb3d4335e17b2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49d8ac501fb356145205dd3651078886

SHA1
06f97c1a6c0f58e85d81a78d9e09aa1f6bfaceec

SHA256
87fb394a20bf8365fee475e8718a2921bccb4923e76e053be03fb91d65716b9a

SHA512
ef1bab0dff13e06181e29f37f9ff35f36221c88169d74d69c3968c7ad27274753483d5e1494241f77e07cd3e4c4b95b8d2fe019732450a52cd3af9c5a651ddf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
61aa6988dfe5570414fc66c5e00aebee

SHA1
7c740e5cecde710c83c76cf17095c71dfc6538aa

SHA256
096d0d59a627eeda274c5b7703b7bcc271e7fee8ef89c0526c87b79373ecfda2

SHA512
4c4f683f228af5c7b20f5902055092fdea0adbe638c778608e55f3e8aa1539f27a47772f54f93da764e30704bba2573eba51e6372b0f5830e6c9aa64a7072355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8e69d9f3faf83893875899841fde827b

SHA1
2c77bcd9124bbfedbac2fbfdf68c3c9013c238ce

SHA256
6bf435e82ccd108e2017838ba435f8bf4169f50eb663d0644e2d1f1f15bc4d54

SHA512
fad15b08d3fac374c5ccbfce23e66281e8dd90674ed270080056c7547fbfc61f5e3b2c8d49dd97117468ebdc62f22824bbbdfa2bb0be186e68634ef695adb5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1541d51834c29a9d10e3235eee43280e

SHA1
bd598a70e3242be13d41bafaa39b637f4712b503

SHA256
647404b09e8d123993ac7e9bb1128aceb19f942752cf05d224ae2e64cf61d4f5

SHA512
e37c315054c2967e2b1b2c53d7176e442bca0f098ff96400a3df83b4ed96feed6111671cddc98dc5acd1107197fbdf5e98ec77254d9f28b862eb83221b57c9c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\A086.tmp\A087.tmp\A088.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5wf6ml2.exe

Filesize
87KB

MD5
aeb3cc05408bc1863e88b910c15dcf0e

SHA1
e699a0b0c2496878f46dd50ab0988f0f1be22b70

SHA256
5e0964cf2a7ef3d02bada774d094ab3dfb204bc637229e52ba7f47e90227baa4

SHA512
e01ef54b8ee9141d3772ac6b11132df48371c52825f80270239f84cf58fac1bf2a5dcd0828fd441804e07fb8f7c2b5920643e4633dc21940d00687d8b25f3815

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LN1mO30.exe

Filesize
738KB

MD5
508dc89f45a007c46c539428df63389c

SHA1
6b22e3ae825510fa830cd0468d5053a095483399

SHA256
b198ef3618efe14d9278ad4fb8d98686508f7dcda50117e5dabbaeab29668761

SHA512
c1a3eb505fb5e9cdb3e2c65008b2a87e093c3e55feaab594feb7b214ebc38cf34f493fefaeb059adf833845533afa59b08292ae5c737689558a4a02c2a8f2da6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Qi486Yp.exe

Filesize
339KB

MD5
1d689050a4a4d60136a4bb2bfe102d89

SHA1
920a14f57c4b7697fb6a5bea6aea2a83213564aa

SHA256
946941295ccf4076e6f3044dd0d1b65de6b9596295e3090f0621a5cc7cd5fca0

SHA512
c01b76154c27bdb318453e56347379c7d0f0f05088a4c7b728713c484802ffe56a93eaeb840452b96a696c472e2bd7332a7c3215cd3c1a57b74ee22ed5d391aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ab6Sl08.exe

Filesize
503KB

MD5
2aeaa651fff4ad5e7990f3303ef24df8

SHA1
7490b85e7d3c879fb285edb80ea9ee14869e54d0

SHA256
0e409ae63423deedd3ce537023ba2a81aac92155f2d7be1678dcb1ab4eb98f5a

SHA512
e3c1f7a1b64730466060399e774b11a36c6b51de18a24d2215b548908c2144530e264c28233c17f97e98ce4716d8b5b6a7f353a8357e3bbcbc910e5f3ec3986d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3du32Ol.exe

Filesize
148KB

MD5
446d103cc7b2318768970d513e356721

SHA1
332d9ce9afeb305cbc7b989bea54b5353ac65adc

SHA256
c89666d5533c12a97644e548a6a1526d2aac5e1c4ddea12b9765462481de36d6

SHA512
f9883e7a368d35bf67f6fb2ca142902a2a553843e1a4c3f84b7a6499d0b4a8363c1aa7d0566be4631d9378858a8bdc6fecc99b16342fd3fac1d220c89fce89ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Yv8bp87.exe

Filesize
317KB

MD5
ebdea3ce8d20b20b52938e5fab300ecd

SHA1
8f7ac02a68b00d3c7d21916b21666c740799b498

SHA256
f523fa279526e755907a7cd3fb100aae2030187e549b63a420efbca0978fc9c4

SHA512
70e756be719bb97a7eb8bae2c3c03220a2653ac3763bdb93ba52cbcca640e9e7594edd9f6a681f236b25c7498434c3746810186473f789cdc359334332bd2666

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1El11lU6.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2WV5607.exe

Filesize
298KB

MD5
4180e4c82519832a6a2cf437e39c7361

SHA1
db364adf65ea28cc19b3f0c78e4ffde46aacb1c6

SHA256
be15d05609ef73f9d85b1e1e31d960c5968e94aaae7d4fe8f71750b2519facd8

SHA512
b0a9ec383a94fd843a06ab6899818b2b6911dde0104044c144046f022520b9f7995104c253bbb53e873d9545e8308e09a23709b9a8df238db00a2e837c702ec2

Download Submit
memory/2132-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2132-34-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2132-29-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3408-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3408-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3408-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3408-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3544-48-0x0000000002F40000-0x0000000002F56000-memory.dmp

Filesize
88KB

Download
memory/4296-64-0x00000000075D0000-0x00000000076DA000-memory.dmp

Filesize
1.0MB

Download
memory/4296-54-0x00000000077E0000-0x0000000007D84000-memory.dmp

Filesize
5.6MB

Download
memory/4296-68-0x0000000007540000-0x000000000758C000-memory.dmp

Filesize
304KB

Download
memory/4296-66-0x0000000007500000-0x000000000753C000-memory.dmp

Filesize
240KB

Download
memory/4296-65-0x0000000007490000-0x00000000074A2000-memory.dmp

Filesize
72KB

Download
memory/4296-63-0x00000000083B0000-0x00000000089C8000-memory.dmp

Filesize
6.1MB

Download
memory/4296-350-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/4296-351-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/4296-58-0x00000000046F0000-0x00000000046FA000-memory.dmp

Filesize
40KB

Download
memory/4296-57-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/4296-56-0x00000000072D0000-0x0000000007362000-memory.dmp

Filesize
584KB

Download
memory/4296-55-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/4296-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5000-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5000-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download