healer | 106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

max time kernel
1791s
max time network
1797s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
Size

1.2MB
MD5

5b3b6822964b4151c6200ecd89722a86
SHA1

ce7a11dae532b2ade1c96619bbdc8a8325582049
SHA256

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34
SHA512

2f0d99af35c326cf46810c7421325deb55ae7ca36a8edc2716a3d32d9e6769e0d374581a98912e22fceeb6973e972463ed8b2fa4d4399043c443fa100dfd17b0
SSDEEP

24576:5yY4YriuQJ5X4SuIcmuBLahxwUzN1YyqoVKucvTNLF9:sY4FuIahGxRMoobNLF

Score

10^/10

healer redline ronur bootkit dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

ronur

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000231d7-33.dat	healer
behavioral1/memory/116-35-0x00000000009B0000-0x00000000009BA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	iwN36Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	iwN36Rn.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/220-46-0x0000000002750000-0x0000000002796000-memory.dmp	family_redline
behavioral1/memory/220-51-0x0000000004CC0000-0x0000000004D04000-memory.dmp	family_redline
behavioral1/memory/220-52-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-55-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-53-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-57-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-59-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-61-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-95-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-97-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-93-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-99-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-91-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-101-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-103-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-105-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-107-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-89-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-87-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-85-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-83-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-81-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-79-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-77-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-75-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-73-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-71-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-69-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-67-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-65-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-63-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-109-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-111-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-113-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/220-115-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
4016	sbO31En07.exe
1244	smS09II74.exe
672	slc39Ad82.exe
4960	sko86jV13.exe
116	iwN36Rn.exe
220	kLG98Ei.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	iwN36Rn.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sbO31En07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	smS09II74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	slc39Ad82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	sko86jV13.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
198	raw.githubusercontent.com
199	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\diskmgmt.msc	mmc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	vds.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
992	sc.exe

Checks SCSI registry key(s) 3 TTPs 23 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009b9629f45cfccc750000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009b9629f40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000010ed3f000000ffffffff0000000007000100006809009b9629f4000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009b9629f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009b9629f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009b9629f4dcfecc6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009b9629f40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009b9629f4000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009b9629f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009b9629f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{0A9C5DD3-06D7-41AA-A9DF-2255A404588F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
116	iwN36Rn.exe
116	iwN36Rn.exe
4980	msedge.exe
4980	msedge.exe
1732	msedge.exe
1732	msedge.exe
4000	identity_helper.exe
4000	identity_helper.exe
4084	msedge.exe
4084	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
1268	msedge.exe
1268	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4332	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	iwN36Rn.exe
Token: SeDebugPrivilege	220	kLG98Ei.exe
Token: 33	4332	mmc.exe
Token: SeIncBasePriorityPrivilege	4332	mmc.exe
Token: 33	4332	mmc.exe
Token: SeIncBasePriorityPrivilege	4332	mmc.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe
1732	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4332	mmc.exe
4332	mmc.exe
2724	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 4016	860	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 860 wrote to memory of 4016	860	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 860 wrote to memory of 4016	860	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	85
PID 4016 wrote to memory of 1244	4016	sbO31En07.exe	87
PID 4016 wrote to memory of 1244	4016	sbO31En07.exe	87
PID 4016 wrote to memory of 1244	4016	sbO31En07.exe	87
PID 1244 wrote to memory of 672	1244	smS09II74.exe	88
PID 1244 wrote to memory of 672	1244	smS09II74.exe	88
PID 1244 wrote to memory of 672	1244	smS09II74.exe	88
PID 672 wrote to memory of 4960	672	slc39Ad82.exe	89
PID 672 wrote to memory of 4960	672	slc39Ad82.exe	89
PID 672 wrote to memory of 4960	672	slc39Ad82.exe	89
PID 4960 wrote to memory of 116	4960	sko86jV13.exe	91
PID 4960 wrote to memory of 116	4960	sko86jV13.exe	91
PID 4960 wrote to memory of 220	4960	sko86jV13.exe	99
PID 4960 wrote to memory of 220	4960	sko86jV13.exe	99
PID 4960 wrote to memory of 220	4960	sko86jV13.exe	99
PID 1732 wrote to memory of 4840	1732	msedge.exe	121
PID 1732 wrote to memory of 4840	1732	msedge.exe	121
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4976	1732	msedge.exe	122
PID 1732 wrote to memory of 4980	1732	msedge.exe	123
PID 1732 wrote to memory of 4980	1732	msedge.exe	123
PID 1732 wrote to memory of 3028	1732	msedge.exe	124
PID 1732 wrote to memory of 3028	1732	msedge.exe	124
PID 1732 wrote to memory of 3028	1732	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
"C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\RequestUnblock.vbe"
1⤵
PID:3824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2456

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\diskmgmt.msc"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf27846f8,0x7ffcf2784708,0x7ffcf2784718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1356 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4784391175947227140,13608763464668352625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x34c 0x514
1⤵
PID:1524

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey
1⤵
- Suspicious use of SetWindowsHookEx
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3769bbb0-c69c-45cd-bb0b-eba8bf005c8e.tmp

Filesize
8KB

MD5
faf965b63a407c8e5b72881f975a4e80

SHA1
4000e700319752452cb20470ae7182b4ed10d9c9

SHA256
a65f2cac148808ab12c68ddda17025d4c44f268b50a90946012b9a38075f4fdc

SHA512
1726c1747c2d728c8192e394dce37dfb3212f421faa4b95008ec261ec2dcc287abe97b486efcfb0a32f576ca69663469178f292d042042d943773c50b1e7c32a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
35KB

MD5
bd72bbee586e1ccd001d0b09fb4a0479

SHA1
d6a9f9e658642090a2982ce8b7c59571ec126d9b

SHA256
d396d7e26505c676cd1bc38ab1c1875417d68120235f79199c40f4f8fcea58cc

SHA512
5b8c5b52edfd060c015b3ead4db3307b56b7de5d90b30022026bd648f694da3a6c033e569ae2fb88e456d3860aa19c63bac5acd4c7cb1ff57b35b57acf534813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
e121064892c625fc705091652713eef7

SHA1
244258d146eb167e4eee2b443f80248eac1d7f72

SHA256
3d89538ba00ff93f6099d3d896698403eff6d920061eb377b7c88e4e49b9bbe2

SHA512
9092236c62017d6f715d936ab66ad40ecf44f9ab95e50c9e65b9766b5c0a9a3ff022b71c701a3fa3d2375c4e6520b1cdc905b81541ddfe0a1f1543d483e0bdbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
32KB

MD5
bbc7e5859c0d0757b3b1b15e1b11929d

SHA1
59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

SHA256
851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

SHA512
f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
9a18f14de3296cf6d7abaf9229febb71

SHA1
b2397530434074d6b98f22a70c0d34b25819affc

SHA256
1146229763b4d2a926d30195497397deb4254d9bf60199f4014627af22d20c52

SHA512
4a80cca2fbffa32b7e7cc053c32965eb3f2224c8c674d991e6ec3e049ad4ac69670f7acab1a82c5bf1a63b13829a31f017b01c700bffb7e6fe4efcdd0f06355e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
13c84a1acee9f792d92454afc3ef8761

SHA1
465522be477f6da36028208f72dd335e3dad3468

SHA256
f064365c9ed54d6cf45dfae2dd851680163d7f4d8832ae95572ce1221df6c2fa

SHA512
20766d911490feeaa025601198794640edcb6208498997b4c6f5da17afae960e4dfa080e792a412b7b5e84ead028f1c9b6fe868c1032762c227ec6067dab1d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d2f926351df156980340be5206e1a10c

SHA1
7acb2ac92fd6ab38c69fa99c0caea3fb6745d989

SHA256
db06e3f6cc1ee7fc94311ebc4041b5f8048a96f7ae0001fef17ead0b9ead34a3

SHA512
b70f926108b72dee6036b51399c89ae794bea986cea8c79dd5f34549a92d2aa863235a23e5c78a90a62e5dd78e779061c8f364bc7e7e1031a5a1e3f9b1be5c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bbb031283a6c397dd08506feeb482d95

SHA1
de8116176b928aeb51dcc6207d6fff60927a3da1

SHA256
34c41013bc91ba51d7a4a91a01503f83da180eeb3b3aad73324bd5c1e1af4ed1

SHA512
984f5d1e7efec5a7a0f7c73b238cabd4abb07dd228b5a33d5de9e4cd3aeb0da32f483981b73cdc8975566798f1ed5814f12bd735b72a580a3050cb0ec69050a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
072c2978863f207fe4a2161a4cd1b2e3

SHA1
819f88b1b8a69f8831b6033e4cc2c97995386abb

SHA256
4c7fa6342eaed04fbe1814649dd54dc9847932bf4dc46c066779e9b6c5bdc9dc

SHA512
48816877912459001f7116cb9cf8b6aa2f16b449838ea038e9f161d557c84972f5c93504e35b8b5c317bb0b5ce511531cf7b2d4b652e91f1959164cd00f326de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5c861ab701139b86b9cbe922089d27e

SHA1
c9a2dbb6869f1cc3a52a22cc18b88b0e458c3b26

SHA256
d456e5f38ef7f9e717132b288fde18656a11feef01ea07cab6be0fd75a34add1

SHA512
9732662037d606c753c14c04431518209e6f1ae312da3c2c4643784c614c4b8ee952437044ff2c56cbd1f6f95c9f1e4bcc90b74520f97def55cd44b23effe6a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3628f3c56720b43acd5d72df364ff46

SHA1
a88f42679d548e2af1290e36e1823c8562167046

SHA256
de57910cdd3c153bf4cbdadbe14ca87d08582a5942fce815b064403559f65985

SHA512
db35f957f7cf4c073474fe730a7c70c92e1f83d4621f1e1933396a95fc89b979c610fc94f8a4fcab858d258353e2f1438cab53eefbcd389691a1f8698da3d00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92291c992af26ba551e850dad4701823

SHA1
0897744d31d9034e36166f3427ed7d1f56257d17

SHA256
60eeb9ddc14d3c64891ae23e42ae03ea50a756905b4447ebce1e761436ccc9c1

SHA512
149d903fd24f2dfed5e2c70e972842cee1a6f9a04a12f5a074fa2cc336316b9961b6774fc2c661a04da7431fb60fd2e233db7ba83c0490b7207016ab0cffe747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1ecf7b636cd028060f9e4e107618f728

SHA1
de2e64de27a3263f30a3a776c7cb03b1860f502c

SHA256
126b178a8208f3601c9211ec43b4213d6d4b12e8168808430dee697af274b6b0

SHA512
ad98a382de4ca84a135f644f491b4c1a1f913e79c655b11b92c7befa7850fd6bc2571e7e4ac9d506a68bb6f90dcf55f8007acbf62c80a8e67016f5ea29ea6803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9713357eda119249b0d5147ac1c004be

SHA1
33b5fedde8e164ac4f9b886551065817dd453e60

SHA256
1295907e4245a084126732e289d6317626ce7933eff62d509acbcf3337e50d2a

SHA512
21424a9a6a4e87d07de1a883c9f8b5efb3414b06a0969894d85ad4b1ef3b571bd3d3e80218900f766fd60d3781f72b31cec00f29dfb648c225cc6367e4c01a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
22337daa03ec9514aae230894ac9f40e

SHA1
906f1f40a19d62213f0ef708b8dfa5e79648eb7d

SHA256
0beeb9e6151e27aff2ad0e91d8c285d25514c5c11bf502440b9d4f84f201be3c

SHA512
23215c59c4db73312fb1c66003c3a3b31d8ab4dd1d8052ed44f8b9591eb0f6dd8a1747f61e3a433bcd03cbecc4c12c6c454fb6459ac3e42aef86281d247ca1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
facae89d93921376735bb9dc27f0851d

SHA1
f5e3a4df1dd0a86cdf9fbd45d4425063605d1ffd

SHA256
2340441e08ea2c44542c2ae7f9868b6ca6024f92a0a5980b7dbd41d4cbe14454

SHA512
34ee999ffd7490092fd178c4ab6a3f912d3ec1db679d3a9c54a368eebe406881141d11cc93dd4d3224e2d06ab901843ba16eba14a40ff1d6721f02064ff40cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
64997f13c609073b352887cea7a6c6bd

SHA1
3ec0684740fa941e03921fc4a0db7fe7e4bbb6dc

SHA256
f064e0d5ca17c0f1ad9ca2c20bfa11eabcb2f33659082b24438b40ea20c78c7f

SHA512
c7182d1dfe441d1a7dbf061eaa3a486b9728cfa8854d991f51ce506f686aefdfc6dff7b1912341b0124ac1e6c5d5c0d395baf08d896f8480985958814b41be3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
41e69d64a625d81a5a3c0459cffdf7f4

SHA1
db012009beca7673e9f8066c2323de0d793532ca

SHA256
fe2f7b4bbb2cbcff3e409fb553f331cb17b43b7ffc51be56a93816c1b04ed3df

SHA512
ac55d446d6a80413c02fa963ca152e7e086ca0f05916bac58af5452badbd9304173923d3a6dbd6b45d8f866c0d1383a65840466beb335dc2317ec896510f301d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebbde16f975eb4aea220b6de5bf29700

SHA1
aca452b82d9ff9180726d8a54bb5842506a464b1

SHA256
d98a6ac89d4ed51cd05389a77f6ee676666d069f670402e9ac941ca4bc530cb8

SHA512
3e0e9942915b8bc977cdc05433ac3be4d6d32c9db40f297aba91044b26d2db5f13852402050a472da9c533d26af5683d3133567bb3504cb1b79ecc6dd0cba0de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a3847.TMP

Filesize
534B

MD5
798a7726eb65f625e3061fd244612107

SHA1
869e71bee4aaad8051fde63b9e200ac6ddc37ed7

SHA256
acb7cab01643baf77ebbc8cd1508761a966825b07fa864de12532e90231f19ae

SHA512
ba082071653fa91d337e9a6c61e6b88b64ad12217cd7c63e1e175158c4f1e6b50a2d00d8ab24d4a9f7be1572357e9288ca61ab2219221e666380129c097fbd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e54af66d-e1bf-4d0e-95c0-5dfd94e81439.tmp

Filesize
2KB

MD5
786d8a952e87bc7c91c8079ce44ac63a

SHA1
c3575e7db13a82d740ecf1e8f7d552fabf757c1e

SHA256
cfe9d04618fcf10c48ae78cb8376631a4f8c1811699ce0ad37e07d283b5b6369

SHA512
861a960f797311f33e8d5c1bf2e3978541911bf16d543e0f06f4fa75f2ad955b3ddcc8cfc66641d0bab905856e159b1a2ebc2884961aceb6fc4a7ccc6502477f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
905f9bc0fd933ae32625bd4965bf5451

SHA1
96dbb611aeea3f30780485df2dab64b98591958b

SHA256
6b0145212ec8f380683ee79f26f2d5f93f07d907a98095be0885a0c6cde2807b

SHA512
cfe1b3ff4ada8519c151d80dc88bedf38fc69b710122e631076c76f8a33bdada6f5480ce882a7acbc0c9c29bb853c6b7eec07047c2a19f8ab290e6f6243d0aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f0faf557ff50926ca50642f68684ad97

SHA1
186bc679d4890903178e4f0401d06d9bfa602dd9

SHA256
cc00f477454499b05e4716c1bc9d20320b7f7f533bed4f0e49893d0b7fbd3b42

SHA512
c1cd3a54e477b2ddfa7fc2392d2df8319f321322225fca3e7de9a8b49026a36bde08ddcc72c152cee232d8958a8aeff5ab172fefc291b530551ef37996bbe23f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a96b49cdbd14a70e2eb5f8a26aa5a724

SHA1
904b1e2ad468b71f6fc3f048cd48d2bc8f08bb22

SHA256
a758c1e3aa7f59b7b424db4fe8947218c2a37274785bcc699d512468550dc782

SHA512
0d6203c7131112ac90a1f424587bcf1e721bb70236162de6619f1a19c3e061434bd26a40a61360fc74e6184b1328ef17b9f4c9c62dabf075216c67d4ffab21a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe

Filesize
1010KB

MD5
f8d3a0a73fbee1e94dcd0fedf9a31c4e

SHA1
71ef31102516e25e3b3aa347b5c697a85d237b16

SHA256
ad974386b5f8a42a0ff8d77d4f6e1919f2bfbe3f4008320acb1bc327e6f4947c

SHA512
81337186639f964ed048b288be37575ffaa989d9d6c6a91a27db8d6bfe5c4fb42f11d63ab32008e485f921bcb774304a6f96cb4e17778dcc38f1e4b072deca28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe

Filesize
869KB

MD5
5739bc2cafd62977daa950a317be8d14

SHA1
f7f582e1863642c4d5a8341e2005c06c0f3d9e74

SHA256
b3cad94dc96473ea46e9af91de2a2126ee2345d47a2d1a926182db447de2ecc9

SHA512
f55320fdf0383e3c7f8a9841c3444b58f9551d879d89ad1ee44388e9621b4b5f0f7e504915012e3acf24b3aa45a3d0f1e692ddee89a38d3987f95fe97d5bae8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe

Filesize
651KB

MD5
e12e7b53183d3b1c6cd53ef42aa815f8

SHA1
9dedb739590a02e37c82e54cc8eb3e0ce57248ee

SHA256
63ac9bdbd61a661f5bc96825ad4408df1312b18f455472b63c66f6e5efb05e63

SHA512
5e4a61453476d524cf3b96743e2f5163c01f3ae1d8f05653d9ed3ffd0614b43afa013554e6c0b0294763e80beca5081fc088ad6e595a2af67115a62f4cce410c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe

Filesize
383KB

MD5
7c29db2ac66b846cc00ca802838c116b

SHA1
23f9d79f7cf7d5fb41111bf4896645d3989b4f11

SHA256
e4519665ce98d8426aceadad26a6bbe92b455f59f6261a8240dcba5b40e6a51b

SHA512
a46c3d3a3e7ff2ae24cf67eed51367cd5b422cc793911d59de19d2ba0c763c29f569b9876ef41ad74ec3e9977ab280100c09755abdc6908e269bce4a1b761cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe

Filesize
275KB

MD5
ef9dd5707f37f0e2f802b3d7856e7bbc

SHA1
e9cbeca90f2edece7174b0fcffe65f311b5b3689

SHA256
de4cdd6ab46f28034be20c1a3231035ac3dc1aafbb443e0ccaaadd3ccdf0fadf

SHA512
24d042eb4715e4a9ed98609fe264bbd1aded094c2efa410e59a3bd800fc36561242c1433e8573de9581bea6e38b9f269dcd6b2eba20e4548e5cdd893c9334b44

Download Submit
C:\Users\Admin\Downloads\42.zip

Filesize
41KB

MD5
1df9a18b18332f153918030b7b516615

SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503

SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80

Download Submit
memory/116-35-0x00000000009B0000-0x00000000009BA000-memory.dmp

Filesize
40KB

Download
memory/116-36-0x00007FFCF17D0000-0x00007FFCF2291000-memory.dmp

Filesize
10.8MB

Download
memory/116-38-0x00007FFCF17D0000-0x00007FFCF2291000-memory.dmp

Filesize
10.8MB

Download
memory/220-93-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-107-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-109-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-111-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-113-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-115-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-958-0x0000000005340000-0x0000000005958000-memory.dmp

Filesize
6.1MB

Download
memory/220-959-0x0000000005990000-0x0000000005A9A000-memory.dmp

Filesize
1.0MB

Download
memory/220-961-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/220-960-0x0000000005AD0000-0x0000000005AE2000-memory.dmp

Filesize
72KB

Download
memory/220-962-0x0000000005AF0000-0x0000000005B2C000-memory.dmp

Filesize
240KB

Download
memory/220-963-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Filesize
304KB

Download
memory/220-965-0x0000000000730000-0x0000000000830000-memory.dmp

Filesize
1024KB

Download
memory/220-966-0x0000000074290000-0x0000000074A40000-memory.dmp

Filesize
7.7MB

Download
memory/220-968-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/220-969-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/220-65-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-67-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-69-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-71-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-73-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-75-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-77-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-79-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-81-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-83-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-85-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-87-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-89-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-63-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-105-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-103-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-101-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-91-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-99-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-97-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-95-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-61-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-59-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-57-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-43-0x0000000000730000-0x0000000000830000-memory.dmp

Filesize
1024KB

Download
memory/220-44-0x0000000000670000-0x00000000006BB000-memory.dmp

Filesize
300KB

Download
memory/220-45-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/220-46-0x0000000002750000-0x0000000002796000-memory.dmp

Filesize
280KB

Download
memory/220-47-0x0000000074290000-0x0000000074A40000-memory.dmp

Filesize
7.7MB

Download
memory/220-48-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/220-49-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/220-53-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-55-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-52-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/220-51-0x0000000004CC0000-0x0000000004D04000-memory.dmp

Filesize
272KB

Download
memory/220-50-0x0000000004D90000-0x0000000005334000-memory.dmp

Filesize
5.6MB

Download
memory/2724-1661-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1660-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1659-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1645-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1643-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1640-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download
memory/2724-1638-0x0000026DCBA10000-0x0000026DCBA20000-memory.dmp

Filesize
64KB

Download