mystic | 653c7aaf5687a35596964be15daf0e34ed9eb8b53525d88301a2d2ad9ae1b410

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe
Size

877KB
MD5

c3db948a2f5d3c222f9765880a13becf
SHA1

cff5b6d7a7a61f55fd168c180e551e2c56e3326f
SHA256

01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6
SHA512

57800406d43c6d5820f9b086243bd74b3d83a4e467c22ed39dc8eeb87a162decf34806063099b333787a7e62695bf3b5855b2a8171478ee516827f22ae133753
SSDEEP

24576:oy7yqLG+0QglMZcRWf0HdeDSbWTlrRtPKYG3Xuv4:vuf4WRWf0sxrOYG3+v

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3968-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3968-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3968-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3968-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2732-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	5ZW9bS5.exe

Executes dropped EXE 8 IoCs

pid	Process
3904	FC7jd46.exe
924	IW0dn40.exe
752	Ho7LM48.exe
4628	1aw16Ms7.exe
2220	2KX4353.exe
3956	3KT09OJ.exe
3572	4vn430CL.exe
2032	5ZW9bS5.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	FC7jd46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	IW0dn40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Ho7LM48.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 2808	4628	1aw16Ms7.exe	91
PID 2220 set thread context of 3968	2220	2KX4353.exe	104
PID 3956 set thread context of 3980	3956	3KT09OJ.exe	112
PID 3572 set thread context of 2732	3572	4vn430CL.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3412	4628	WerFault.exe	89
3524	2220	WerFault.exe	95
2260	3968	WerFault.exe	104
3144	3956	WerFault.exe	109
4020	3572	WerFault.exe	115

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2808	AppLaunch.exe
2808	AppLaunch.exe
2252	msedge.exe
2252	msedge.exe
3244	msedge.exe
3244	msedge.exe
3432	msedge.exe
3432	msedge.exe
1804	msedge.exe
1804	msedge.exe
5148	identity_helper.exe
5148	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 3904	3900	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe	84
PID 3900 wrote to memory of 3904	3900	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe	84
PID 3900 wrote to memory of 3904	3900	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe	84
PID 3904 wrote to memory of 924	3904	FC7jd46.exe	86
PID 3904 wrote to memory of 924	3904	FC7jd46.exe	86
PID 3904 wrote to memory of 924	3904	FC7jd46.exe	86
PID 924 wrote to memory of 752	924	IW0dn40.exe	87
PID 924 wrote to memory of 752	924	IW0dn40.exe	87
PID 924 wrote to memory of 752	924	IW0dn40.exe	87
PID 752 wrote to memory of 4628	752	Ho7LM48.exe	89
PID 752 wrote to memory of 4628	752	Ho7LM48.exe	89
PID 752 wrote to memory of 4628	752	Ho7LM48.exe	89
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 4628 wrote to memory of 2808	4628	1aw16Ms7.exe	91
PID 752 wrote to memory of 2220	752	Ho7LM48.exe	95
PID 752 wrote to memory of 2220	752	Ho7LM48.exe	95
PID 752 wrote to memory of 2220	752	Ho7LM48.exe	95
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 2220 wrote to memory of 3968	2220	2KX4353.exe	104
PID 924 wrote to memory of 3956	924	IW0dn40.exe	109
PID 924 wrote to memory of 3956	924	IW0dn40.exe	109
PID 924 wrote to memory of 3956	924	IW0dn40.exe	109
PID 3956 wrote to memory of 3200	3956	3KT09OJ.exe	111
PID 3956 wrote to memory of 3200	3956	3KT09OJ.exe	111
PID 3956 wrote to memory of 3200	3956	3KT09OJ.exe	111
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3956 wrote to memory of 3980	3956	3KT09OJ.exe	112
PID 3904 wrote to memory of 3572	3904	FC7jd46.exe	115
PID 3904 wrote to memory of 3572	3904	FC7jd46.exe	115
PID 3904 wrote to memory of 3572	3904	FC7jd46.exe	115
PID 3572 wrote to memory of 3768	3572	4vn430CL.exe	117
PID 3572 wrote to memory of 3768	3572	4vn430CL.exe	117
PID 3572 wrote to memory of 3768	3572	4vn430CL.exe	117
PID 3572 wrote to memory of 4324	3572	4vn430CL.exe	118
PID 3572 wrote to memory of 4324	3572	4vn430CL.exe	118
PID 3572 wrote to memory of 4324	3572	4vn430CL.exe	118
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3572 wrote to memory of 2732	3572	4vn430CL.exe	119
PID 3900 wrote to memory of 2032	3900	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe	124
PID 3900 wrote to memory of 2032	3900	01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe	124

C:\Users\Admin\AppData\Local\Temp\01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe
"C:\Users\Admin\AppData\Local\Temp\01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FC7jd46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FC7jd46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IW0dn40.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IW0dn40.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ho7LM48.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ho7LM48.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1aw16Ms7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1aw16Ms7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4628
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 552
        6⤵
        Program crash
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2KX4353.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2KX4353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 540
        7⤵
        Program crash
        
        PID:2260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 148
        6⤵
        Program crash
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3KT09OJ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3KT09OJ.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3200
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:3980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 572
        5⤵
        Program crash
        
        PID:3144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vn430CL.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vn430CL.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3768
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4324
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 596
      4⤵
      Program crash
      PID:4020
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ZW9bS5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ZW9bS5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C0C0.tmp\C0C1.tmp\C0C2.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ZW9bS5.exe"
    3⤵
    PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,6478626860488861025,2570086120630639819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,6478626860488861025,2570086120630639819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        5⤵
        
        PID:2640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
        5⤵
        
        PID:924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1
        5⤵
        
        PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
        5⤵
        
        PID:5028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
        5⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
        5⤵
        
        PID:5192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:5452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11728786368886556400,9494450674268728072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
        5⤵
        
        PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:2236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11467173029094998541,5228109986097260632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4628 -ip 4628
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2220 -ip 2220
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3968 -ip 3968
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3956 -ip 3956
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3572 -ip 3572
1⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
19446288cc43a503a15466fa18548195

SHA1
e50faad7ea69c67fe8e031f850f22fb05bdfef27

SHA256
06c4e3ebb10f95280b3bed1f33b725a004a4db0235edaf9e2593807001021c02

SHA512
eeaeacd0ae1b29c1305a11c287b030bb34cc61ce01eb499a66c681db661e8e33b9055012d647689f12bf15ef2074c3634ee44c0fefa5be868df5e1bfb36c2983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a41db04248882a77c165ab13e7f9837f

SHA1
c7fd2579f0e3488fc9aa23d6db3f076697f3130b

SHA256
49a8276561d39476b9f78ac975d05e7dfe9f0777d8e8f2f97f234c72121ffdf9

SHA512
32c58a0ac9199a41a0fd7e2714d9f94248cec670c435bca903bb2adab3063ddfa644097446e945c15e1ab173965746e7c1e539d48eed94c58fcf26fa2906cc9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
afc96068837044bc660709a965fc893e

SHA1
31c397efc8c27cb0a11e6981cfa19bf580883324

SHA256
de41a49432de7ea1ce78352be69e1af80131ae2c298e691cf7868c5c3f2d02c4

SHA512
2967d0c88966fdf47b13a1e78f26af212474cbf211aaf6e2b65a3aef6a4baf08f70bf26b761d650502845aa631e5914dc6ce1681f87b1b0f9fc9ac399258ef97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
630e5b4022cd8de93140a6d31b9c2b37

SHA1
96af73dd964a17ca785981a9b14da73c216ee107

SHA256
4ee5d8572f9c964c68a1c1b6c5fba794f6fb18f080a9da886c5f8549ecf16b0f

SHA512
577d2a0f3dec8d7530d0371c2f07fa4305ee84641b77affc19b2e1ed2658a1f45863dcca2ada4b8eefeab9eade97c5309ee6e956ba733d731a7bc18ada2adb2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
341128a41d7db47982dfbabfb9187034

SHA1
86a26f823dd83c133ecdb77c8e86f4df27be9a40

SHA256
a5c270fbf5cf7c6964a0041c1f8bea82ced033f6ea8d86530323254839499bbe

SHA512
d0476f839bcd38511354dbf0121bb101c7ff74c8b481672ed9678b83a66e3675059205cd8be9aaf191e4b7e944b8314144f725ec46cb6a43f3de99994d15c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
a85f7b69c132b905cf2de7557a6a5d01

SHA1
f1fa737d8385aba2d2247ff32da0699f9088d023

SHA256
9f5df0f98d46a7c5d3c44f8d0578195336fc24936ac954ea997b8a780cef0e96

SHA512
05776ff685f5fcf16afc24ae5d1ca5bbdddc0ade854a20dc4541dcb663ca4cad9698c3c3ab540cc3165c1dae7bee45648f0132197007524e4c0f8f03a773ad38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
428899b0cdc76cd5fdfda6f664a4afd5

SHA1
803640d2dcf60950d486d5125eb5f99eb45eaf70

SHA256
eba6a16081807a80a495a69d18589b732f688f62c27f67f4d128d284c4e89d6e

SHA512
b4da1e50ea436d68ac5818cccbe8b5f8670fd45e31ba305c952dd4a07366cf0113a4ffff7c42490fa1e0bd02c584f6c0e8ee0cd4d17ba3dfb2d19bb91066093e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
71c46609ca93a9c0885f0b8bce750734

SHA1
edbd1bcb05116872d0dee3fc78991948a3426912

SHA256
45396c65b7a1e1b9d6a505fd825a8dc359fb278c7c02f14a8e3d4a24077c4bdd

SHA512
abef425f98e8f3a2c63aba81f383dbc1a7cef0cf649fe3515de4443927881982b4e36958e7c83465bb1dcc1af8bbc3bf60f90cc4fd33ff0d02c002a0b182efdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583728.TMP

Filesize
48B

MD5
facb507131f788bc07a9132f2464475c

SHA1
397f38ef4ff89b19842cc6c2d52b27ef8a61c07f

SHA256
c1be1f58dced96241b9815d4b451c7ca50c2ed7f62a6d6472859e07ab43570c6

SHA512
f37402fd4c515425186c3a3a7ae293ac42e0a4d7b5aa834bef04ce7f6c61bbcd197a5602044121a7af542bfcf859a62a3989157002efd811c82cff65b6f60c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ffeb0c74e9984bd2a461705bcf284c6

SHA1
b670ee29232db74592d1682f753e13a286ba8221

SHA256
9d40a16dced27be8607fd1979a7f0292d594c14330b624369e9f51a5cc0d071b

SHA512
0bb016c3c4a06d48643e6c1dace30dd53f9fac84cdbf8b1af56879c4d76ac449a9abc43fe18569b1cdeb59d4d6af349b32c8535881afc185e2ce69b682a9fbff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
acae0f3a9e48202fdc4b92cdbbdb214e

SHA1
a543016dab08d2de1afd3fcd243c03e3fb4251e1

SHA256
430c82b5c7af04e04be398171e07c7425f33903df6999498ef971bb028770bcd

SHA512
5ad6d8da037f30ce1043551effbcd808f56e24dad1967799db537b43aadee6544f5874fc58373aeb7be85d798f876df1b5b61f1f914e681d057780fb0acc3328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ba537ac4ebefd40b109a1be5df17c4a7

SHA1
778e9791dd33c035cd681fcccc0533fc0f2f3dec

SHA256
fc439ba3f44b25aee2b10848713e8f08d33d5b2c6ec4e8275cf1f14305aeb9fe

SHA512
cbc9cc86dcc030e2209e8a083a1d826c58ec31701b80f47d3ca076ac005251d2fe83cf0898edfaa456cba81dc99aef64be79c4892230d5188d1e3013eef32de1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583709.TMP

Filesize
1KB

MD5
6a2f5599226b3654e0f6ad3a1bf79765

SHA1
7d9dcc4f6efc452c74ef012b1744f3182b51b9ce

SHA256
5559408bc8cb13a5aee73f4bdd0e6ada5ca5944d929998d0587eb35234eecd1d

SHA512
3bc32dbec43c994b4e42196a6379f01675bf1b9c29330eb0275d195c27720295b67da396903645f9dd2ce14120337fc8fd5255058bef8a2b20a0b3757d388d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6435c3dcd12bb21a842b8b82fa885096

SHA1
c0d262c1683d31811b17e3d9f717a1ebadc0cdf3

SHA256
ee8373e4f35706e3e937ca255724dd97b16578f40050f531916f951260897d44

SHA512
4be430bc90f5341dd4e908a99da3e4569aa91dcef954ef5e949310e4b20c6e3f3d26e16fa5ec05b7f5f1a3547894a78686de1c32df3ecac14fe6852def99fd74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
35c56142ae40a0f7d44921ca3de55862

SHA1
4d1996651793f7ec5b688bf044422a9b547207c8

SHA256
2f4f856067395aa6a177b217bdb9db8e30878f7aab15c141cc6cd8ebe7a4a3a2

SHA512
524cdaf5eb87756e72d751e8c540f07ae2689053d90795d55a28a9ef8bd2d208f78eb9ad8b058f3121b2b50709f3c8d8c359d9c5e922d95350199b107b0a6faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c48380120ac830fb56a1c2df53ebae9f

SHA1
74fbd73002d0941a27d9c9f3b6ad3288ee2751d8

SHA256
4336d3f34ea9aeff76c78b766feccaf80987e8ceec5322d313c440dcc159f326

SHA512
170a7ae7ab784d80d9e657df3dd3641b8de51920bb80a21faf69e1274b7f1950ee3a92faf57f950a2a9d18927473d396aa3d7d07d4fa927e11b7ba1c56260ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp\C0C1.tmp\C0C2.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ZW9bS5.exe

Filesize
87KB

MD5
62c42a1832c929686c581f772429007b

SHA1
0d9a269685e4b7eb3bb68cd990f22d1e6272f869

SHA256
1d27db456c7aa962172a4d32c2d96351f669db9e0483a0ca54d4c72c852f4afd

SHA512
de6acd500c799533a8cd27d5d33f35e538276041c3cbb3cfcd9a5d1f475efd83d1a3a96ff6249338dd87985e34e7a25c45c66bced65f8e31b873635d7259d44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FC7jd46.exe

Filesize
737KB

MD5
842467c8bfeba1c1be0c779abaa8fc9c

SHA1
ace7c85bb04c40fc88ee1f1892db7ad138a78163

SHA256
b01b40ce172d37fce3e7569fcead046c4ea69642b4b6e481deaac77be8c4d12d

SHA512
fa003b50d5c39bf84ab54497aa69f67ade008b9cc6b24bfa238f1a12b7c61984b21e5cfec44380d99c9b52bdb5b4d17efda46d4b22f8e873c7e26289904bf0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vn430CL.exe

Filesize
339KB

MD5
c8401e841ea5a045beced21da68aa003

SHA1
32ac85bd4f908151bb3c3002f69ca452fc065809

SHA256
be335fd38f35f3fee07d52b10b1804bea6b97644a642f9e299a5d87178bd6c0e

SHA512
e19b8061d80eb6bc088831880c3391e343ceebbeed8b3cff5b7401e2c8eb6d2bca58733f205934d8ebcf8901ece6b34c093911e269941c3b81b94bf2b07aa028

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IW0dn40.exe

Filesize
502KB

MD5
0f31b56b376180ef80cfcc4c1b57ef2a

SHA1
04ebc9b46a3717c811733f4ec0990b84d1949b1b

SHA256
4d82d8406cf88896e5c9f6f18de135b015ded9fd233a031fa93513bf9561e154

SHA512
81b9cce674afc11ae688b020288d5d993d6e765f53c2a2b824f7b98f52edbcf6e941d0648b9cc4f6c79ea9a047868c693d674137be64972c6dacbf061453045d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3KT09OJ.exe

Filesize
148KB

MD5
fb6b51b84523bbd3242e615ae8749006

SHA1
47a99e92fba19adf22312326ab01c9a308501dc3

SHA256
d42b1a1138dabf9fccdb73963d3793e7ecdeea9fae84d62741e020a1f72769ed

SHA512
8cafa9a4bc3e051f3a175e69b4133dae345ccae3bd2a554dcb9b736c9c2ca9b81522947aceffc67a4d6b8193cfc1e9a5ae4bcba43c737b66d6d0e68914946c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ho7LM48.exe

Filesize
317KB

MD5
71dfd78bb9c314ba5d48e8b11fd1391c

SHA1
fbb9cd0f0505e4b205c8d73ba353e4e134c8f392

SHA256
778d030b062f0689eea94585505a57b5b99f3712f618760eda4cd15e59326925

SHA512
d9adb822804773d69c3ac910a3e3c03e70a1602c663db3819801a01ba31578e9ac79b0131566cd9216b0078f73ff9c934236ac100065fa03757404fdfc57be8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1aw16Ms7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2KX4353.exe

Filesize
298KB

MD5
9b3f3d71754a4c45afa18ee97f980f1d

SHA1
39be55a77ace90f5ea41d7edfd19153dc32fe5d6

SHA256
f0ad9ec446661313f1aa8bef230b6e16722d61c701ec98ab780ead2de3bf1187

SHA512
c47f6aa51b73835926d32900f25864501455a23cb00472364c1751678a2e72775c3e76463cc884ff35b3c1f4beae3f7093ec5ecb4db531c0767f20ff029dbd98

Download Submit
memory/2732-61-0x0000000007DB0000-0x0000000007DC2000-memory.dmp

Filesize
72KB

Download
memory/2732-52-0x0000000007B00000-0x0000000007B92000-memory.dmp

Filesize
584KB

Download
memory/2732-62-0x0000000007E10000-0x0000000007E4C000-memory.dmp

Filesize
240KB

Download
memory/2732-60-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

Filesize
1.0MB

Download
memory/2732-59-0x0000000008BC0000-0x00000000091D8000-memory.dmp

Filesize
6.1MB

Download
memory/2732-54-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

Filesize
40KB

Download
memory/2732-53-0x0000000007D80000-0x0000000007D90000-memory.dmp

Filesize
64KB

Download
memory/2732-63-0x0000000007E50000-0x0000000007E9C000-memory.dmp

Filesize
304KB

Download
memory/2732-51-0x0000000007FF0000-0x0000000008594000-memory.dmp

Filesize
5.6MB

Download
memory/2732-50-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/2732-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2732-352-0x0000000007D80000-0x0000000007D90000-memory.dmp

Filesize
64KB

Download
memory/2732-342-0x0000000074570000-0x0000000074D20000-memory.dmp

Filesize
7.7MB

Download
memory/2808-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2808-29-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/2808-34-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/3968-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3968-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3968-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3968-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3980-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3980-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download