mystic | 4f664c42adf81ba9b3ad736a26f7a72c45d641a4164aabc6062e33f3ba2e62e2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
Size

878KB
MD5

042e9ff3eb2884903c304965a6c3fd2e
SHA1

d488b60fb1d1f0ada321fbe25554b3d79d95327c
SHA256

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93
SHA512

e804377f2e5495ec1a4be6d257ebaa67ec269fc13c6436824b36c8ab31e236633c86b699ae8574d96b715d6ee7bd8bafb319387ce527b3546f857351886d4153
SSDEEP

24576:byWSFeOSZ0QV/2J4UcTjJjAysYTz5dvqZym2FVKKJ1Ka+:OWCC0QVOaj/Jj1VX5dw2TfB

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2364-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2364-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2364-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2364-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/636-52-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

5cH9uM6.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 5cH9uM6.exe
Executes dropped EXE 8 IoCs

Processes:

ud0hz17.exenK8Wq41.exeIN3ZU44.exe1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.exe5cH9uM6.exe

pid process

2268 ud0hz17.exe
4840 nK8Wq41.exe
3992 IN3ZU44.exe
4912 1st84YK1.exe
1564 2IZ2656.exe
4312 3Io85bi.exe
620 4iZ500Wr.exe
2900 5cH9uM6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	5cH9uM6.exe

pid	process
2268	ud0hz17.exe
4840	nK8Wq41.exe
3992	IN3ZU44.exe
4912	1st84YK1.exe
1564	2IZ2656.exe
4312	3Io85bi.exe
620	4iZ500Wr.exe
2900	5cH9uM6.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nK8Wq41.exeIN3ZU44.exed33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exeud0hz17.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nK8Wq41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	IN3ZU44.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ud0hz17.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.exe

description	pid	process	target process
PID 4912 set thread context of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 1564 set thread context of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 4312 set thread context of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 620 set thread context of 636	620	4iZ500Wr.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3684	4912	WerFault.exe	1st84YK1.exe
5112	1564	WerFault.exe	2IZ2656.exe
2632	2364	WerFault.exe	AppLaunch.exe
3832	4312	WerFault.exe	3Io85bi.exe
4476	620	WerFault.exe	4iZ500Wr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeAppLaunch.exe

pid	process
1328	AppLaunch.exe
1328	AppLaunch.exe
2332	AppLaunch.exe
2332	AppLaunch.exe
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404
3404

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AppLaunch.exe

pid process

2332 AppLaunch.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe

pid	process
2332	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1328	AppLaunch.exe
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404
Token: SeShutdownPrivilege	3404
Token: SeCreatePagefilePrivilege	3404

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3404

pid	process
3404

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exeud0hz17.exenK8Wq41.exeIN3ZU44.exe1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.exe

description	pid	process	target process
PID 384 wrote to memory of 2268	384	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 384 wrote to memory of 2268	384	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 384 wrote to memory of 2268	384	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 2268 wrote to memory of 4840	2268	ud0hz17.exe	nK8Wq41.exe
PID 2268 wrote to memory of 4840	2268	ud0hz17.exe	nK8Wq41.exe
PID 2268 wrote to memory of 4840	2268	ud0hz17.exe	nK8Wq41.exe
PID 4840 wrote to memory of 3992	4840	nK8Wq41.exe	IN3ZU44.exe
PID 4840 wrote to memory of 3992	4840	nK8Wq41.exe	IN3ZU44.exe
PID 4840 wrote to memory of 3992	4840	nK8Wq41.exe	IN3ZU44.exe
PID 3992 wrote to memory of 4912	3992	IN3ZU44.exe	1st84YK1.exe
PID 3992 wrote to memory of 4912	3992	IN3ZU44.exe	1st84YK1.exe
PID 3992 wrote to memory of 4912	3992	IN3ZU44.exe	1st84YK1.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 4912 wrote to memory of 1328	4912	1st84YK1.exe	AppLaunch.exe
PID 3992 wrote to memory of 1564	3992	IN3ZU44.exe	2IZ2656.exe
PID 3992 wrote to memory of 1564	3992	IN3ZU44.exe	2IZ2656.exe
PID 3992 wrote to memory of 1564	3992	IN3ZU44.exe	2IZ2656.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 1564 wrote to memory of 2364	1564	2IZ2656.exe	AppLaunch.exe
PID 4840 wrote to memory of 4312	4840	nK8Wq41.exe	3Io85bi.exe
PID 4840 wrote to memory of 4312	4840	nK8Wq41.exe	3Io85bi.exe
PID 4840 wrote to memory of 4312	4840	nK8Wq41.exe	3Io85bi.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 4312 wrote to memory of 2332	4312	3Io85bi.exe	AppLaunch.exe
PID 2268 wrote to memory of 620	2268	ud0hz17.exe	4iZ500Wr.exe
PID 2268 wrote to memory of 620	2268	ud0hz17.exe	4iZ500Wr.exe
PID 2268 wrote to memory of 620	2268	ud0hz17.exe	4iZ500Wr.exe
PID 620 wrote to memory of 1144	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 1144	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 1144	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 4536	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 4536	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 4536	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 1664	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 1664	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 1664	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 620 wrote to memory of 636	620	4iZ500Wr.exe	AppLaunch.exe
PID 384 wrote to memory of 2900	384	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	5cH9uM6.exe
PID 384 wrote to memory of 2900	384	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	5cH9uM6.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
"C:\Users\Admin\AppData\Local\Temp\d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:384

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4840

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 580
6⤵
- Program crash
PID:3684

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 540
7⤵
- Program crash
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 136
6⤵
- Program crash
PID:5112

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 148
5⤵
- Program crash
PID:3832

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:1144

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 572
4⤵
- Program crash
PID:4476

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2900

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C6DA.tmp\C6DB.tmp\C6DC.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe"
3⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7fff010a46f8,0x7fff010a4708,0x7fff010a4718
5⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,9204992456789324469,15053823829460220888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
5⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,9204992456789324469,15053823829460220888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
5⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff010a46f8,0x7fff010a4708,0x7fff010a4718
5⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
5⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
5⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
5⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
5⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
5⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
5⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
5⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
5⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:8
5⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
5⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
5⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
5⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
5⤵
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
5⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,23993575798314155,170019993695328936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
5⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7fff010a46f8,0x7fff010a4708,0x7fff010a4718
5⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5567996073825639581,10803693861048814291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
5⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5567996073825639581,10803693861048814291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
5⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4912 -ip 4912
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1564 -ip 1564
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2364 -ip 2364
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4312 -ip 4312
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 620 -ip 620
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c56840936ac3821975a1c24845d0a1e8

SHA1
7424b58e7863772559bad915260c41248c654a08

SHA256
d93d4d31ea4bf5ca8d4232eeabd4acea4f7bcfcea215f44367f30e2cdd48a754

SHA512
a93fa0a7ffbd77be9b3bcf7b717cff5af754b77d7e51f7ef597d3f4ef029d6f2c29edf6a155d24c611517e7f68d963577a57e88786a31bfcc7c140e2e5a6275f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe6cf84c30f901d604d931cf5e51f4a4

SHA1
8f4420508848c93a743a6f1da33061f2d85fd30b

SHA256
ee261a9530f50720c5c9003c4f853cedce284ec8055016f626639c0a83e5112c

SHA512
5795b6905609eda9330a17ee05b573a1572ccbcf7cf96e2c86ccf868ec6f56df0361a3276d679fbc855b1794b84f65f1ac76e0da31d486a9acc01597599ff1c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbb65eb0a0aef243640d1a1b78438342

SHA1
a6eb312dfb8a54220c8aca11d01f54cd506a816d

SHA256
5d70e4c420d36affd1710226b3f811bf043c7d1e394df003b861d5c585cb761f

SHA512
c91856bf2a711e96946a059e1f56bc1a53527e34fa411575c955eed131b63cabd3fdf28576b1c27e5aefa59756fdfb0961be7bbf55b026048de2ef1f1f193715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a7720c94ca5606f915fd49d99301ba24

SHA1
f17f5efadebe0e4bae23e4bbd9dd2bbff47f7108

SHA256
8a977c655d30cd839dbec3219120b222510e364e32cd7e31d870384a4d9f5fcd

SHA512
3113db428f750672f076b79aa77c565cb9e94a1b2fc12937396defbbc456b27faf5daaba8ba225f408c61c942f029580d41ea8a2e940d414f464fec7a2d9ee4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
65f694d7bfd2c820c65be61aa4e73e7c

SHA1
0741eded7aa8e7cd930f2ba9f082c6de0b787c0c

SHA256
4219f8944e3cc598cde3a98e56b647061da7607fe6698de6316552a99ee35c88

SHA512
29900c8c9d8fe8cd2fc6fb53189124953d22af0350daaf844d9dd9975273adcce36a75edc87574220dab9952ad6d69f6ed6d7c681360a0933677ac65d2ccbcbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
287b0ffe0bc0d40023b2a2c3b2661c9d

SHA1
709234bd37691ea4718f39fbcf27a3736ca26f76

SHA256
379c4fb26e1fe2863813e08bcca83cd894dc133298b8b1d5b76112bef13faf39

SHA512
0bc5486b6396fc599d23ee2aad9c84b35ce0de3456d1e1864b7ae9d3830a0902d0689cd097fa500b358433911206e403b71bbe71ba5d7d087d7b7931081c79f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
8535fef07bbd28660b433a4d08cf8c78

SHA1
d3049eacc332848cb6600d0b231564b64d901aa7

SHA256
43d7b94829bbbb3a11c122ed49ad09d57b3cbe3c567838ffb6c23d07a1cda940

SHA512
8ba898397f72a24979d8134d90d0f0208fd141bd188ba17dd9c70e99a4afcd56bb2f9698c8f7200502df52c3f3531429460813962f9f355fcb1b37fb15b94483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
07ed0bd68ec522e25a8845297d64ecfb

SHA1
030ad76be669d4f412447babdb90eb61d8fef0e0

SHA256
f6472676423f0e9332dae309d7db695aafb26f6dc6df07a95c3e0856be8d3b2c

SHA512
1934444385a74b658f3e48448ad4a9d1f77783c51bf99ba6426c0145d607b3eb5e02e855bff190f83c560d977cc28483d773cdef02ac557b593525864b46fc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583b9d.TMP

Filesize
48B

MD5
2eb6c81f1c1eb8e68f5fbb70e86ed06f

SHA1
5215dbeac1bc9450c8a8a10a23f6bad3668ab15e

SHA256
38f5782470f2ab41f30ddb94a2350a0290c9cadb1044213be4e5266a8c1c9296

SHA512
1f67ee12e6ae73d7f86e4633f9d79af2a3af0d9d5846a92a0f205381333c46730bdc40d35a5559137ca01ddfc32ff8d8ad693ade45cb7a54aadd06e5b9fe8480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f866bd7b41536c2c33cbd451cc7c8362

SHA1
c109344ef2d0bdaacfc4b6f9dc20cf977fba9341

SHA256
f0af1918de8b14c976f9681515eaf933decbbf4cc83cde95b7f5c014f63fe701

SHA512
5ac9bbd0448078c806067703b37b660138795d89f5935adb323e802734ced784c8b89f0beadb4a8bb66979fb3a3064bafa9acf39844fc3791bb5146e8026769d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25d4774d83c0945ac5f73e6839056f54

SHA1
37ff53e5201f21638d17f91a9c3c339e7a1a8678

SHA256
33a07c235852a2fdc3dde2faa85a481ba28a6cc847455860d4eac2fdb079dc75

SHA512
5f491e4bc1495c0fe6bce3df82a89704bddce3382cd169bf594d49cc7bd3d9fea7d2d73e8fc0fea04369d372bfdacfe6838da644369ea67054d485d572cde280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5e5abbb95f0023b148fd3a76fef92f5d

SHA1
43f4a987ccc6a0cb7a692045ef32d04ea06dad43

SHA256
c21b7e01e243dd329b63c5434f62c03c9a1256e5ade492d19599f674b9688201

SHA512
74883f6134daff0b123ffee571a363824c44e72ba81ddc361c62d357db82c8252a1086080a8f17736dc084a41f14e5b106deb87438374a3bf3be00a2f48c45e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5832b3.TMP

Filesize
1KB

MD5
7186ef4f6dca8a8b3f26b2404c60cec5

SHA1
51c49394fcdff7ec248f15ba98d8e9c34a5521f0

SHA256
7f436531beb362ce3a3235b1cb3dae7faa32d4e639b95c8c0395f7101fecea22

SHA512
21349ed5db8cb12824a51175bd0c52ca01e22c243e8c8268eeb29fa602d899d82ee5471daa746191144a558a7aee98c22840a8b265d20db0cbd4a2574da96cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e52b87bb-8390-48ac-9564-9681f42c81a6.tmp

Filesize
2KB

MD5
3670b6caa6c082b81b43548538d823f8

SHA1
c5e916cbce23dfe6d6e06a6dd33c37c8ad49c2bf

SHA256
c7831c4869b96db04c318c2aacaa4fc34e60bccfa8eb7048013d003dfc66a84e

SHA512
28fe5b18564e95e7fb2083d294b86b34a5315915b8ffd063365abcbd2c21b3fa8feaa0916c945177a83c8351b31c52336d657d664e3d3a463da74addee44cfe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f14f8cf83ed666e69e3e82e584e91304

SHA1
e85d8bda32895312ed2e938e7e91872bc994b39d

SHA256
e3ca5c29c41874bd28557ec05ef05146c77a27334b53da1272bd9e40b1405897

SHA512
9595961eebf37daf423be17067bc645ae8930e90054498d33fff952bc96569f45a0c3fc66b24cc9139558b1d8e082d4492e8341818f59ff18e83bee876ce4c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4207bf8d6c89dda1c29e3b8a32bebf19

SHA1
080096dfd37e57c1d65ac18649300f0e12e2048c

SHA256
1cc81a5cb79a75459f6357dec2640e96ac5cef11b5a772d562c615596d3e8d44

SHA512
eaf5b5273364b0a1c7e1e4f67fd627b94a6bf5883ff64bc2089d5be816ecd6162deed385674afa2c2430b44b02267d16264a0fd44fa9785bbe0c0008a5819a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d70b17befba6678d9444035496027fcb

SHA1
803c21ac21b89b1fdd57466caa3865c36b001d6d

SHA256
7f88280d3c72d4c8f4fd114703fc7655d0ec11b22091e87343f043cdb25482b7

SHA512
07538c0bd9fd1f24ebd7320e74de8fd72f7bb1508c72d26ee4aae4c9e6ebe7d65caaaf69c40fa2870731f2efe00d296a73904b84be6fcadf5cb88d1f63759260

Download Submit
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp\C6DB.tmp\C6DC.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe

Filesize
87KB

MD5
fb67f34d0ada2990f0278f5648f32541

SHA1
57ee472fc5ce8dcd0c6b1565c89a32a09b491ba8

SHA256
4973b0dc69db1989b694dc8a0eff4c56c67bde6b1ff2a6027f6f4f1d1a281bfd

SHA512
31994b7b3dea3c7645914e3d22efcddcdf31dafb6747851c1759be12d2be8c02fbb493b5435980a11da5b6d6c9058c08686bb210e508b133162af4f82f3d10aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe

Filesize
739KB

MD5
a673bd803898cc35bc8e5e5bb0de1ceb

SHA1
9d9b0927e0013fd07a36dcc125e0d0c5e3daaf68

SHA256
d05ef131874285781e8795684dbf902e01c5827cbc2c1dbb56a5ed3bc8a7af45

SHA512
19370e94988b9a2ad56b72086c7df2c6220c1572d9983a4755220a4dec5a32e11ea30d0e045a64bf9da94862287de025b10898a9be2ff5790ec8ed0226315915

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe

Filesize
339KB

MD5
584b2345f19a49499216acc7c40ff35d

SHA1
c5d369114119b01919e05ee42903818482884640

SHA256
d7ea43683b0c02b6017d7a942c9b83f3af24466b139e25889c2c8ce05978c8c4

SHA512
504b9ca061eedcabd189b1f66d9831f0413ee5c934a700a266633876dff965986bc99fa18167e785d30a192fbe9d3e092de097f9e034f7157c76565d1c140059

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe

Filesize
503KB

MD5
a3072f223d8b127f5d60ab7e17b4c16d

SHA1
ddd6ca99b8b24b7ec0b5cdbec67f09ff373b62d7

SHA256
4a00b95401194bbc4d92435711b95cddbc756cc9c6d83a18c9352c383574af2e

SHA512
65455c9988317405b2592d9389edd6dd3ca8e0333aa3563d025b8304165fa1832ce786ba90ee16c3d63fee8167bf2b79aad66102a313dbd3176ce3ac598328a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe

Filesize
148KB

MD5
b038b0e342643bc3a0bc3ad8055cc565

SHA1
38319ad09fe941b356f7427993e76a13deacf395

SHA256
96ac531d92116544f2f0c6395f0da21a3415842f8f125451c7cab40910658a3d

SHA512
b6ac665ab5d00ad09b738527e97617ddf8ee28e0d70e7839f0cd736f92026e93111c89714a07437bf240be8b20b906b840abacca5f92db9bf74d7f292e4624a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe

Filesize
317KB

MD5
2bb5bba4a8eab90ae7dd7cd043be1b33

SHA1
89fa57099ff9f4b74b2057720d95eafa1167a095

SHA256
6e926873fec3965c4f9a185b4b0cf3ac0c7ae82ca65559fbbdedbbaabc69c270

SHA512
59609a664408ffa09696d5ef0dcb913d7623aa111b045bf2862f72a37b873ae879d44b3fca680cbd03e28ab0e0b075e9f8d7bfa97c5f03ddffeaa9e1009b8762

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe

Filesize
298KB

MD5
528d0a001176d87152bd55ab7f963d95

SHA1
2750a4077744ca041e61d0ce40ae1daf4fd2b5fe

SHA256
8fe1e47cd448e306870845cb9173ef88a4dbeb1dbb6fa28008ca174048710e8e

SHA512
dbe80101ae3b78ebb103c98ac61f1779ab36047917ac8dacff3c8dba73cf9051d80bc3e91592ffb3b9674d989eeb47c68b72ed2421a0936027a7e71a4b91d3ec

Download Submit
\??\pipe\LOCAL\crashpad_2820_WFMLZIPYMIBBXVXP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/636-65-0x0000000006EF0000-0x0000000006F02000-memory.dmp

Filesize
72KB

Download
memory/636-56-0x0000000006DE0000-0x0000000006E72000-memory.dmp

Filesize
584KB

Download
memory/636-66-0x0000000007060000-0x000000000709C000-memory.dmp

Filesize
240KB

Download
memory/636-64-0x0000000007130000-0x000000000723A000-memory.dmp

Filesize
1.0MB

Download
memory/636-63-0x0000000007E80000-0x0000000008498000-memory.dmp

Filesize
6.1MB

Download
memory/636-58-0x0000000002100000-0x000000000210A000-memory.dmp

Filesize
40KB

Download
memory/636-57-0x0000000006F20000-0x0000000006F30000-memory.dmp

Filesize
64KB

Download
memory/636-369-0x0000000006F20000-0x0000000006F30000-memory.dmp

Filesize
64KB

Download
memory/636-55-0x00000000072B0000-0x0000000007854000-memory.dmp

Filesize
5.6MB

Download
memory/636-54-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/636-52-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/636-67-0x00000000070A0000-0x00000000070EC000-memory.dmp

Filesize
304KB

Download
memory/636-368-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1328-29-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1328-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1328-34-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/2332-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2332-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2332-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2364-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2364-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2364-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2364-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3404-48-0x0000000002FD0000-0x0000000002FE6000-memory.dmp

Filesize
88KB

Download