mystic | f9565cf61bb3c7a2977310e44fdb6b08d407f3d56424e88086708737269f9f59

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe
Size

877KB
MD5

f19b25a510f738c87d225ec095f62267
SHA1

7c88a8cfc3a21a191f30a0a25a7beade95aacdbf
SHA256

c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e
SHA512

35a18109ada15f0425bccedf610d6a46f3d6e1490a63caa3ccdf3d0d6db0020a3f98f39747a762aaf310e4db3b3f2300649fb06281b5478ef4288f8c78a31548
SSDEEP

12288:xMrNy90/jzTZ7vwCgfMHrwSTw/xQdvTccDJbrLK+8+4hIE6afosGF8fU7pTMRJv:4yEj+C3jw/xQpcQfLP8M5gQsuq

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2736-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2736-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2736-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2736-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4844-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	5CJ1rm5.exe

Executes dropped EXE 8 IoCs

pid	Process
1628	Th6gh38.exe
3652	Oz3YC15.exe
2300	vo3qF46.exe
3384	1rW97bb7.exe
2928	2Qy9729.exe
412	3qA90Ce.exe
2404	4Yr455ir.exe
3432	5CJ1rm5.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Th6gh38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Oz3YC15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	vo3qF46.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 3028	3384	1rW97bb7.exe	93
PID 2928 set thread context of 2736	2928	2Qy9729.exe	101
PID 412 set thread context of 2260	412	3qA90Ce.exe	109
PID 2404 set thread context of 4844	2404	4Yr455ir.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3724	3384	WerFault.exe	88
3220	2928	WerFault.exe	99
4800	2736	WerFault.exe	101
4512	412	WerFault.exe	106
2820	2404	WerFault.exe	112

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3028	AppLaunch.exe
3028	AppLaunch.exe
3244	msedge.exe
3244	msedge.exe
396	msedge.exe
396	msedge.exe
2244	msedge.exe
2244	msedge.exe
2524	msedge.exe
2524	msedge.exe
4588	identity_helper.exe
4588	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1628	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	84
PID 4624 wrote to memory of 1628	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	84
PID 4624 wrote to memory of 1628	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	84
PID 1628 wrote to memory of 3652	1628	Th6gh38.exe	85
PID 1628 wrote to memory of 3652	1628	Th6gh38.exe	85
PID 1628 wrote to memory of 3652	1628	Th6gh38.exe	85
PID 3652 wrote to memory of 2300	3652	Oz3YC15.exe	87
PID 3652 wrote to memory of 2300	3652	Oz3YC15.exe	87
PID 3652 wrote to memory of 2300	3652	Oz3YC15.exe	87
PID 2300 wrote to memory of 3384	2300	vo3qF46.exe	88
PID 2300 wrote to memory of 3384	2300	vo3qF46.exe	88
PID 2300 wrote to memory of 3384	2300	vo3qF46.exe	88
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 3384 wrote to memory of 3028	3384	1rW97bb7.exe	93
PID 2300 wrote to memory of 2928	2300	vo3qF46.exe	99
PID 2300 wrote to memory of 2928	2300	vo3qF46.exe	99
PID 2300 wrote to memory of 2928	2300	vo3qF46.exe	99
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 2928 wrote to memory of 2736	2928	2Qy9729.exe	101
PID 3652 wrote to memory of 412	3652	Oz3YC15.exe	106
PID 3652 wrote to memory of 412	3652	Oz3YC15.exe	106
PID 3652 wrote to memory of 412	3652	Oz3YC15.exe	106
PID 412 wrote to memory of 3888	412	3qA90Ce.exe	108
PID 412 wrote to memory of 3888	412	3qA90Ce.exe	108
PID 412 wrote to memory of 3888	412	3qA90Ce.exe	108
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 412 wrote to memory of 2260	412	3qA90Ce.exe	109
PID 1628 wrote to memory of 2404	1628	Th6gh38.exe	112
PID 1628 wrote to memory of 2404	1628	Th6gh38.exe	112
PID 1628 wrote to memory of 2404	1628	Th6gh38.exe	112
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 2404 wrote to memory of 4844	2404	4Yr455ir.exe	114
PID 4624 wrote to memory of 3432	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	117
PID 4624 wrote to memory of 3432	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	117
PID 4624 wrote to memory of 3432	4624	c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe	117
PID 3432 wrote to memory of 4576	3432	5CJ1rm5.exe	119
PID 3432 wrote to memory of 4576	3432	5CJ1rm5.exe	119
PID 4576 wrote to memory of 2244	4576	cmd.exe	123
PID 4576 wrote to memory of 2244	4576	cmd.exe	123
PID 2244 wrote to memory of 3396	2244	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe
"C:\Users\Admin\AppData\Local\Temp\c3451f17e68d7115f4d2304d7102363fd86a8fe137f2557445f9020dd081584e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Th6gh38.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Th6gh38.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Oz3YC15.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Oz3YC15.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vo3qF46.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vo3qF46.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rW97bb7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rW97bb7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 580
        6⤵
        Program crash
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qy9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qy9729.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2928
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 204
        7⤵
        Program crash
        
        PID:4800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 148
        6⤵
        Program crash
        
        PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3qA90Ce.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3qA90Ce.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:412
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3888
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:2260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 572
        5⤵
        Program crash
        
        PID:4512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Yr455ir.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Yr455ir.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 220
      4⤵
      Program crash
      PID:2820
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CJ1rm5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CJ1rm5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BDB2.tmp\BDB3.tmp\BDB4.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CJ1rm5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
        5⤵
        
        PID:2116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
        5⤵
        
        PID:5096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:2264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
        5⤵
        
        PID:4452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
        5⤵
        
        PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
        5⤵
        
        PID:5208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
        5⤵
        
        PID:5244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 /prefetch:8
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
        5⤵
        
        PID:5644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,16003578881428264883,17817789216622270359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
        5⤵
        
        PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:4352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,5739991381843775965,4120369102188418226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,5739991381843775965,4120369102188418226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:2160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x158,0x170,0x7ffb624846f8,0x7ffb62484708,0x7ffb62484718
        5⤵
        
        PID:3760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,18177162508163379737,4638562923397568310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3384 -ip 3384
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2928 -ip 2928
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2736 -ip 2736
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 412 -ip 412
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2404 -ip 2404
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22ed2233-342e-4f43-a27c-e90f59cfca76.tmp

Filesize
2KB

MD5
c996b3d52b8de33e6ad22fdb2ff19437

SHA1
91e6e34a5f81cb8c1fbbd8e0743bf03872562281

SHA256
a04489935f85ae99e08aa4ee663c7cf0e8fd4937c4fce0ae387134d39ba95195

SHA512
5136ae956b43b82bea6528149c9c034539789127280b5cc7ecac08e772c14e65ded743371eb0b03ed052dedb246750348c0d56f8d827c0908ffed93176695de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
67899f3ee7d3025e73f348fa068991f4

SHA1
6be0484fb1b1884e3b70b80c0f91962fdb86914a

SHA256
b1a6cf9eafc98493ffd409c3ae09117f4e4f379bcefef69bafc40459ee26e74c

SHA512
61d6750b6a20f135c9274057d9e534013a80bbeb1fad22e7f488f252d51a19c4a2ca338f7d62db19136225a7df26e875fea78f7617b608c813fe5ac6a489baa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
689b523ed10f67c4d4ccf181c60e76a0

SHA1
03e6561087da554fdee9d5418a772ff86cf7de2c

SHA256
8f3615b171422ee34e28c87ada67a0a6282457b2a0eccebd3f63e34902c12a01

SHA512
52a91f25f61107103d4db6474a8d03bffcd85c23e2cb2fd6ec88841e04be318ec75b81c82ec61f94824f6433739c27f4154b7d44eabd41804ed81a501ad9ed75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b5470e065213d9085c860d940f040528

SHA1
081302fc27f649b0e74160fec30c46a020139963

SHA256
5d554bdb211c58136ca32117f2a16b2fd76c25d1b3633a05e5249c744d4f98cc

SHA512
2d7960b0389e8fd94b467c852fe60050d4ea43eb1c3de94a67ce1b26ca3b9d9710863c3d24b28b715adb7b3f1606da0aa3d2f2698b0324634bd8823635f169d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec31b066924130537e77ff38fe84eb62

SHA1
0b509c64c53b8aa1b2071fa9822be844a0fd3e49

SHA256
c9324005e0e4340fdd1b4318d5612764e70069f30422dd8c663f0a63cba5f265

SHA512
44aefa965676665d2b6b2ce97a81a445598ca7915a34ed59c8c631a423e00c4f10913843e188a14a722bb42f9eb2d9def2a2bed97ac212804dec2e37a23188b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
49ea2a80c22cdc9572399b6f962bc608

SHA1
17f2fee524728db43fdd4d96020e384e9b62245f

SHA256
b5ac709cb7be5619b7b55fb397132ba19e2faa2399a2a75714ca90c6cf6e6c8b

SHA512
7ce1e1d42e1dec4d3f23c876a60d607d1b9279f7d1b7e8f45ff61a609d7d4e5eeeda615cf0a1851086cff264af277a2daac3a261b7058280c204b73b0ad00416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
bb7cc290bb8d1bf392320bbc62716c41

SHA1
3563f5a59a707661af62be6da2fc26dc4c65043c

SHA256
36fec9d36ae9d1ef9a7a4631f69ad7a447b0af10c23d7798548fa6c008de35df

SHA512
d9adc2e438648fab1a5a616429d3c2e79dbbace514f4633d5dd0909915c5bedd4dcbda732cd94560147d8348615e7e36da5b64e0fa33b8450c112b1a83cae94f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
b08d0debf1b75a1fd43813c72fe50f86

SHA1
8b5c5f9c492d6d2d328c0ff8c575d1661cb9fe78

SHA256
60105514e76d404bb3d60163f9671395ae06f1e2de055963c8d78c59e3964886

SHA512
6f9b4ed3ad648dca6d3d3c216402563fdfed060380c03eef283bde6e1508bf711ee2062d7205bd97771e7c09631cd28d205236d2e8071d3be7c199e0ee33862a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b8d2b7e220680bd78fff3533c072217c

SHA1
6216f092344d39f9cd2ae5d4bf2356b8ebe506ff

SHA256
425ca53cfb8f4190a589a2ec74827fb6168af5d8ede0f9898f98298763566c4b

SHA512
fae26fab026acb4d62cca5239e2c3e6895eb6e8a6c43a2d6864eb7a13bf639733f2089c880545b5bdea41018c5b9fd9bd7075955756028dc29b1e720e535a451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58369b.TMP

Filesize
48B

MD5
334f0222e11bf82a731fb1a95fde57bf

SHA1
b8fac1b9192c66ead939950e39629230cd7e3e7e

SHA256
0a150888c542789182d558f4f94afa7f2c3bb11a294afd07a34001ebbce21edc

SHA512
01596c74512405b72533dcb5af780752092df4f1606486feba8895611e5c6cad33a562bf08131381e72473f49bf97a3c603575a3bec0cb2d324b89ec5ceceb8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0b5075d1267fccf57752c80d5c4d385

SHA1
5ffce9d1311fee3af704970e13b681127fb2b1e7

SHA256
606adba5e89acb739af7b300ca2e8a83ec6680f32700652d56bfb7e530ec3d0b

SHA512
71dbf8b1cbb6c9c94641f8f59cc30551cd70f26748a44cd584843c5fb24b4725aa6e7d48976d6cbaed99798e6d88d9d06909a9abc6badf5dc7d09622db6bb18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
99e2e0444d7298a62f56ac0ffb0e9e86

SHA1
976e52089f5530cdf9900da90768b209624666d2

SHA256
3094d20365016754a1956932021a8512b4f42a51f05efe177a44ab53ba56e3db

SHA512
7c8f37081bd828b8db0c87817c11a4a67cd1cc332d9d27c81efc82f742e8842ec1b2ca414a38350942cc3d94cdff63f3085b98f1674db2770e6792c9e39c5ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58658b.TMP

Filesize
1KB

MD5
da180a2f0d5904d12abe8c64bf9eae86

SHA1
deffe958a382307ed92515371e0b0d17c4c20abf

SHA256
8374d586135a51d1ebfba8e51ff9bbc783950019d5d75479d4a6667efa929f71

SHA512
4ffe7699ef74d1bc0b4e96a44bcac88825f0875bc004b9846f79bfb0023a56c02ea1f76daffc8e61efad56d66395a77ec2c47ef012907593d752aad7828e0daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aeb01d7d6533a130a0662988bc5155cb

SHA1
407730cab502c89f7c51be86f0ef477b658c2ea3

SHA256
5bc99f032241de005b0755882bf73a0bd8efd0a7c2d1478d5ab8d12f2992ebd5

SHA512
2858a7238119146ca1081aed8c9e83e85ad72d48831205f3e0bfbb1a1dc3467a11206356a49ed6d62b55895fecb0b9336cbfad924a87d0bab92e59f0536681b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d193bc467e39e3303c1ba5abf5c0dccb

SHA1
3903159ce5f1bdb5d4b8a92a5c26bb5759135ad7

SHA256
76aba72aa5cbe3ba1139e2eb35a31390b27533de7ed34f000a66b7bdba558e2d

SHA512
c917ee0a837313b982104773e2ff59862ed312cf221178c36638b497ae3a27202a3f618ccd38c69bf69f44c3192da734f6e74f4fd537bb78f5fe11bea8e7ec45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
3dc4f01c4c711cad883e7522205be496

SHA1
ef649db4dace9bb96a198e4e2ebc401c3a25e42c

SHA256
c3c2af9176a6f6009656bb65a58b17ec224503deacbee34e6754d129ad2856ff

SHA512
ce7272ba22bf8a920ee4aac7077dada48722f53298c6ad101f7036a1b372475778853cca6409de2943cb421dfe197335ca3d3f6f207cf6c1bb6341df5f5e5af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp\BDB3.tmp\BDB4.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CJ1rm5.exe

Filesize
87KB

MD5
8fdbcdf69756212c26265494d6b48b68

SHA1
47b61df879ee63e90654267d9f7cae9aec548007

SHA256
70bf24c2ae00cc33042d7974bc99548d06e342a1a16d46515276f93465df3930

SHA512
2dba1fe404aa1432c98da2e5e55dcb15334489f295bf476a76638d5d897cfc35c14e3ca34763d272d224e87f46f33f3733564e552b3499bcc2a1f61c348005c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Th6gh38.exe

Filesize
738KB

MD5
eb4d87e410a1fb72ad2b92d33c9cf014

SHA1
210da3028f81eda237e02655c0be7b63a6626ca6

SHA256
ad1a7716e684adbc8aab2b1d000b7ac4683ad0fd933eb958aed195fd080eff51

SHA512
6f4db4bb4800aa24a3cf926dd7ed47b3ca4ab053eee2d0e7dcb6235961f31690c28fbfaa8899d76a6f6f7ac6b12ec05535add4243511d7f291e9888cd8c62fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Yr455ir.exe

Filesize
339KB

MD5
b873c479e5174e962e8a46c8de273ea2

SHA1
aa0bacaf27e655711524d320ca19a0050eeb3594

SHA256
dcc6e53c4a14ab2a552a29ce131bd3cc0fed2eb86ef368f4f2f8c7734f0736d0

SHA512
5f2f36a3c13c98c638fef25af900c169737475f09b69911529ccc1805aeffb0faa8533b2178cedfdcef8656d90645e215c9fc35ac465ff9a09a5ee8539e3652e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Oz3YC15.exe

Filesize
502KB

MD5
399574d2ced80025a44d285c686b62b5

SHA1
dddf44b15109dd0e139c3abdb2c40197a5e2d4d8

SHA256
2c9dba10975988724882dd7f4ba67d23ff5a9d008f5d16a48b093ca57a99f24e

SHA512
afc38dc250e3c8d3dfcd84931325f347236c3f2bf8f5ec10ef5b4b459236516dd26d9474ca8edbc2f6881ea5c51a3b4b1c92136d33835556cd6f45e207c3de1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3qA90Ce.exe

Filesize
148KB

MD5
a9afafab6fb81ecb65dceeba5a1d4d82

SHA1
915fcd8b648d40a617eba4b19f276ea28565e5ab

SHA256
c28ce7312f9f25c1cff89e223ff94979ccd8f17ed746d6ee717dbc72d28c4e3a

SHA512
04a8f202efc7380575c74aacc445c6f9b67cccd207f552e0ab2a12b5bcfafa5de930f7869c4f3d6771403a23e923de8b9c35004c6475391589333e6824f34e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vo3qF46.exe

Filesize
317KB

MD5
2e9294e4f8750ebd247203d4e1d1c707

SHA1
07f90f42d0dd91ac4a117b274d559d146748f8bd

SHA256
08b4f38ec48fb6c55fa73fb9b440fae90f559dd500eb98025af380da886f85f1

SHA512
d92d0a3a73a9b46334a413b0de399a73f71ef60670d49192e11b3cefc64d67dd7705d99229b5867b2c9c333865e71552c1975d5e65865fb32a79ab288f233a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rW97bb7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qy9729.exe

Filesize
298KB

MD5
763072f054f1aa5e4f54ed7600d8672f

SHA1
63fa7fd186f6f2890c06f63c7c29963613048acb

SHA256
6686e011cc119e64d1bc1dc52d9f0caf0fecda60969eb458b4a05678577604ee

SHA512
4db443aa2e481393c2bb0116664e9f23cfbcf3403c96f01bfd1794af23a87ed1a823293254f45a2fd212d575ece65da1411c4b479cb1e1646fc3806aa114cab4

Download Submit
memory/2260-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2260-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2736-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2736-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2736-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2736-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3028-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3028-29-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/3028-34-0x00000000749A0000-0x0000000075150000-memory.dmp

Filesize
7.7MB

Download
memory/4844-54-0x0000000007EE0000-0x0000000007EF0000-memory.dmp

Filesize
64KB

Download
memory/4844-50-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4844-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-333-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4844-334-0x0000000007EE0000-0x0000000007EF0000-memory.dmp

Filesize
64KB

Download
memory/4844-51-0x0000000008260000-0x0000000008804000-memory.dmp

Filesize
5.6MB

Download
memory/4844-52-0x0000000007D60000-0x0000000007DF2000-memory.dmp

Filesize
584KB

Download
memory/4844-53-0x0000000007E20000-0x0000000007E2A000-memory.dmp

Filesize
40KB

Download
memory/4844-63-0x00000000080A0000-0x00000000080EC000-memory.dmp

Filesize
304KB

Download
memory/4844-59-0x0000000008E30000-0x0000000009448000-memory.dmp

Filesize
6.1MB

Download
memory/4844-60-0x00000000080F0000-0x00000000081FA000-memory.dmp

Filesize
1.0MB

Download
memory/4844-61-0x0000000008000000-0x0000000008012000-memory.dmp

Filesize
72KB

Download
memory/4844-62-0x0000000008060000-0x000000000809C000-memory.dmp

Filesize
240KB

Download