mystic | db697782cf909776181ac61571c8cea7b322a8516dcf2362080fe0587c0c8439

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe
Size

877KB
MD5

eca05379305a79927fa28d92dfae17e4
SHA1

04dd6087a27ae3c952e37f7e3376d1684c4d89c2
SHA256

df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f
SHA512

399cc8ae6be5a08ada89a58409e5c5e97a6e936d140279066b90133ca0cdb3efbf36f90f2c480abcdc3849471ce56de4fa35c22f94bc7fc3923143dfd800b644
SSDEEP

12288:mMrRy90OZS8MmmyqQaai0wpNTcHMPAqUA/im7He4aHKOC1AzOIwV:vyb/myDaaRecsoqFimDe5Hsy8V

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4572-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4572-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4572-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4572-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4196-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	5ci6Cm7.exe

Executes dropped EXE 8 IoCs

pid	Process
764	sn9jA91.exe
4032	gg0Mr52.exe
864	SN8Us39.exe
4668	1dK35Zk7.exe
436	2Jp0041.exe
3480	3Fp53jU.exe
2404	4wJ775Kj.exe
852	5ci6Cm7.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sn9jA91.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	gg0Mr52.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	SN8Us39.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 2696	4668	1dK35Zk7.exe	90
PID 436 set thread context of 4572	436	2Jp0041.exe	98
PID 3480 set thread context of 1868	3480	3Fp53jU.exe	105
PID 2404 set thread context of 4196	2404	4wJ775Kj.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1756	4668	WerFault.exe	89
1772	436	WerFault.exe	95
2112	4572	WerFault.exe	98
1208	3480	WerFault.exe	103
2680	2404	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2696	AppLaunch.exe
2696	AppLaunch.exe
5056	msedge.exe
5056	msedge.exe
2488	msedge.exe
2488	msedge.exe
1124	msedge.exe
1124	msedge.exe
4380	msedge.exe
4380	msedge.exe
4480	identity_helper.exe
4480	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 764	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	84
PID 2336 wrote to memory of 764	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	84
PID 2336 wrote to memory of 764	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	84
PID 764 wrote to memory of 4032	764	sn9jA91.exe	86
PID 764 wrote to memory of 4032	764	sn9jA91.exe	86
PID 764 wrote to memory of 4032	764	sn9jA91.exe	86
PID 4032 wrote to memory of 864	4032	gg0Mr52.exe	87
PID 4032 wrote to memory of 864	4032	gg0Mr52.exe	87
PID 4032 wrote to memory of 864	4032	gg0Mr52.exe	87
PID 864 wrote to memory of 4668	864	SN8Us39.exe	89
PID 864 wrote to memory of 4668	864	SN8Us39.exe	89
PID 864 wrote to memory of 4668	864	SN8Us39.exe	89
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 4668 wrote to memory of 2696	4668	1dK35Zk7.exe	90
PID 864 wrote to memory of 436	864	SN8Us39.exe	95
PID 864 wrote to memory of 436	864	SN8Us39.exe	95
PID 864 wrote to memory of 436	864	SN8Us39.exe	95
PID 436 wrote to memory of 2128	436	2Jp0041.exe	97
PID 436 wrote to memory of 2128	436	2Jp0041.exe	97
PID 436 wrote to memory of 2128	436	2Jp0041.exe	97
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 436 wrote to memory of 4572	436	2Jp0041.exe	98
PID 4032 wrote to memory of 3480	4032	gg0Mr52.exe	103
PID 4032 wrote to memory of 3480	4032	gg0Mr52.exe	103
PID 4032 wrote to memory of 3480	4032	gg0Mr52.exe	103
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 3480 wrote to memory of 1868	3480	3Fp53jU.exe	105
PID 764 wrote to memory of 2404	764	sn9jA91.exe	108
PID 764 wrote to memory of 2404	764	sn9jA91.exe	108
PID 764 wrote to memory of 2404	764	sn9jA91.exe	108
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2404 wrote to memory of 4196	2404	4wJ775Kj.exe	112
PID 2336 wrote to memory of 852	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	115
PID 2336 wrote to memory of 852	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	115
PID 2336 wrote to memory of 852	2336	df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe	115
PID 852 wrote to memory of 2072	852	5ci6Cm7.exe	116
PID 852 wrote to memory of 2072	852	5ci6Cm7.exe	116
PID 2072 wrote to memory of 1124	2072	cmd.exe	119
PID 2072 wrote to memory of 1124	2072	cmd.exe	119
PID 2072 wrote to memory of 1656	2072	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe
"C:\Users\Admin\AppData\Local\Temp\df577e470c318e1742981d5f4029734392e3ef74366b554a77e78023590fc57f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4668
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 552
        6⤵
        Program crash
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:436
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2128
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 540
        7⤵
        Program crash
        
        PID:2112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 588
        6⤵
        Program crash
        
        PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:1868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 148
        5⤵
        Program crash
        
        PID:1208
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 148
      4⤵
      Program crash
      PID:2680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EF71.tmp\EF72.tmp\EF73.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff88d8b46f8,0x7ff88d8b4708,0x7ff88d8b4718
        5⤵
        
        PID:3532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        5⤵
        
        PID:3152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:1900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:3504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
        5⤵
        
        PID:3740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
        5⤵
        
        PID:636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        
        PID:4452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
        5⤵
        
        PID:1960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
        5⤵
        
        PID:1696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 /prefetch:8
        5⤵
        
        PID:1684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
        5⤵
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7054133386152136960,3792980011009574778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:1656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff88d8b46f8,0x7ff88d8b4708,0x7ff88d8b4718
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15850352506326224769,9072042739598637826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15850352506326224769,9072042739598637826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff88d8b46f8,0x7ff88d8b4708,0x7ff88d8b4718
        5⤵
        
        PID:4124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8931781637586029149,3195376461188740508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4668 -ip 4668
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 436 -ip 436
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4572 -ip 4572
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3480 -ip 3480
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2404 -ip 2404
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62677bdc196e22a7b4c8a595efb130cd

SHA1
bd2adf18caf764c8f034c08b6269d9693875f3c8

SHA256
b540616d7e73ff22642f4fbe2bea0f9daa2f1166391e76cf817b2a93e0bd41d6

SHA512
d23c3b9662eea6a75382242fb8e8084abc1127afbd2632f161df71a2aefaf223621511e1bf6229cf7e86313101a8d9dfe2f20e1c0bd481066e1969cd6fa75e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22bb6af63c7710354ac7070e45ac988c

SHA1
34d29d6b316e39ed8fb8c5efb42c4269040fcf1f

SHA256
1a70d5d3dfc04e6f5cfec1ceb06676039229f895f30007fdb55b043ed48ab4fb

SHA512
42c12820b5237caa5b4d5149901f84db6619a69e85cb869df06e07b3cad1b51e0c2d0545ee0129cbc8e7947fd8c2989def537ad2d58a1d5bf2c2a1bf60041ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
900f8f03741b72da7819295d4348ab8a

SHA1
ee8bf76b91117fa77fb1b0e8d1b10e60843c53f0

SHA256
f637d234e170dac372b4129783ee46aa545bbdf9595fefb452dd9a091429ea69

SHA512
2722b6a58b1986d9540798ceb86ac89c1511eec9d481f786ad65a0018f03235ab93f0844d115f0ce0fa99b7f47266e2caecc622b898959366599bd75b0dbf580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
52d17ae85ed810d6539bca4da77c6fb4

SHA1
67cd12bd2b6f7966d0eb08aeed315152e855d22a

SHA256
d5c4e82f91b79d8fd07745f64f1e1e6ca32900f5bbf1056fe4b30678b26ca6fb

SHA512
74642125e822879b09f846ec21e1b5598fa589cfe8f1c58e7d0b87fb4c0f4ec7e0bd1947ddf587817ae744db3bceee30dd77f5138ef331abe27f59c8facc178c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9785a131fc52481eb38f3d2b51ed0e32

SHA1
d8ef0f392d207fb62073f50d281fa48f61e6c07d

SHA256
2dea53b591c7de644d9bc79b3e3cdc9857bd6079ee094f36bbb397120d66ae0f

SHA512
fd7c669e01a11cad15971b7c98679cd28d65b176b686eae9e2350e75feb0a449bb27a6837e5f336abdd5fc78355ca3f3b58e5bfcc89f0b78795ca2bfea9b05c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a502680d6aba118b152da90d5bf42a2e

SHA1
f4ba5e9a047e7c2bacbbfc494fa92d4f535bc4cc

SHA256
d3ee5ed3f0545be0a255e9a8c3cc74a2662b9d5ea23cbab45d051c04a6a487d7

SHA512
880db5526a7b83144fa38915c7ec0ea955b758e24e95a94722fcac6857490fed4194e6e7bdba6a6a7fc1fc0920e54a68015f71df5d2eb8f1aaad86dec44a5314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5090dcabd0cdd9e292a5212a24d5c53

SHA1
440070e2934a1dff60a445f3e3e5dd2e14219967

SHA256
ed7a7ed9204db4ccaf3cf29182e554cf13fa8e9378cd7e53aecc32651c66581f

SHA512
6db78250bbef43b2e89764fc594382753f2b4f2c6a63f0b2fd567457324154f4f42d3b1847b4cb63fa56e042bc7d101eaf4ed228698c2b97335529ea2605e226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e47ac9ce4a55cbbcdae1a1f00f42c3fc

SHA1
f1d11e593fffe543b564a699b8bf29be8157f984

SHA256
75e9618269c8dee5c0baa51907685265b6fb3017dc2efe36caf7b46cc4196261

SHA512
6195a8822fb3e6531a84f7819ee282294870b3419ef54dd7efbb99ef46ecbf1407ef895267123f0f232b778ee46a7f5b8e1306f6243d78269a90ccc3a30fb089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
5faa4c759925f2a1fa35a13047de45c3

SHA1
90904a9d22cb5136af980f876ccead1bace44c51

SHA256
013e4aa749c67457f4f47e0b53e1a5edd1ef02aaede5fdcc7f1fa84e2222aa41

SHA512
59fc9de1b210d9659411057054a797785add88bc03a8b9a60f44b732e316ed0640ebb0ea5210ca5c674da701fe0fc7e8014c8417d4cef4ce4d8570d303264874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
e7520f7e47dcd8b86f55598e906f6042

SHA1
df15a1b22d7fa256f1eceebb4d27e764966b3b0d

SHA256
9c284b29c93582b4bfcdf81a3416583ea536ac2be3df481fac141d211d7b9337

SHA512
6574da18ed79a500ee9092297e5363a470981e1207c7f718c7332aa3cd19d97f5cfe6f5245dd6c8ff7f916f24b2ab24960b042403952dac53cd8bd00e040b087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
d10b82ac0e055f3c0714b030cc1f4aa8

SHA1
b3403dde0faf2fd73ca6782f9d8a8b5ea14c22f0

SHA256
84e769a5fa69916cc6b414e98496e07325b727c39dd4fb38c909b0d369a7b11b

SHA512
b5f91407f4b8ccc5cf8b505beb02741794a6341e9c66509629b0a6ecb42f0feab39823d50150ea58a70facfdd06d4a59cd1c5afdaab13806f5d4c89cddb18d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3353a7651a6c7070544c89b71e756593

SHA1
9713405421901fd1fa3a851fee12b920dcd25d23

SHA256
3a35362ba028819b9d59a73ed05e3c641cfe1ee76b673957b7485915b3a1c3f2

SHA512
b1acce28bc6331ddd5e81bbb5b029faaff3f95191cbafab9a19f55d2d2317e13151df449e822a3aeb1d4354f8a1c4f250d1a1300223d8abba99560db7a817320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5871d0.TMP

Filesize
48B

MD5
a212d82255a39f349f4c60f73740d7a6

SHA1
141fe55572e7ae3f7ca684b872f4ca3478510fb9

SHA256
8ad08b05bc8cec1e04bcff556be3fc9d5f6bb8b7b02504cde264544bd735a50f

SHA512
78e455188db543b623be289e87809bfc57191cca235262d981fdc43f40f8ff8cb79ae2db0591b26d519e92ee36882202e70dc3b348742e40e0722efbe7a96bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0c4e584f2e5a4f7102b86626fe924a17

SHA1
625142818e21c6d72a910a139dca7d2af995554d

SHA256
218803a55fbcb17d92eadde749c57c201fafa18d990750ccb561543434deb580

SHA512
9adf8437e0e19bcc1843487879c5607f4772e00a5f44732d2c4391049e71baaa52cbfa71d33a4254b69f873cdb85a2862d75d7f800be2792d134240c9e8ffe6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4daca544e44c243ce3095f2091ba8d24

SHA1
2a6af3d2a5370427de338b5ca76a1f55c3543daf

SHA256
ec7f767c4a1a9c0342122399639112eef4b18dc3c522120d60c84ed31afd1e43

SHA512
47ae8f57071873f9659ac5abca4e9042252b3121ac98c394a8728d2581adaec1f3eb2fec3bbbc90f2356dd702fb975d22a6499118ebe29258660c3ffaaf7afe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a41b.TMP

Filesize
1KB

MD5
cc8983372686df18156cb3116fadc114

SHA1
c2d9627238f9c21d5dc48eda85902a0fc02385af

SHA256
8e8e24b45b8ef5b48b292f83369697830d4d506735bfc39de800b96d4d6de7b6

SHA512
931086bd3c148a0493c82ab169fa8cefad407ce83b2ba64dde542feb74cdfe8b1d32892dd19f25cccad7f4a13f41f40c0dd503f470b5f07749ab9ce3c5ca246d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e05cd974300f3587298836453e16b829

SHA1
8f5ae1acf8125aaf5efa28125bd62e110e57df08

SHA256
22a06a4bdd01bca146cd94271b6f84311f855cb340b13a22563064d61e8e2430

SHA512
a3c83e7e817f878de484d1ecf2fd6e5b17f04ae0eb5c7f73008e838745f1d2d343a3549ea85551cea35e763d51874bc89e958623d194e67bf32d80dbafceb8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c108bea578fdca1bd8945c93139ba91e

SHA1
ba9fd70869d151fdfa5e3a85fe936e4d122e255f

SHA256
aeb3f26df1b3902b153a95b31406c732e5ce0bfbe4c1e20c54bf973980faea54

SHA512
4190fc4ad5bbcb9e9918b858c0a01d5a4e5c76d60521f6d46177f45f91ee356cac0833b5fc68ba26ca393caacff66df05cf05352cf9593130be60954dda8faf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
545cc3f8b3c716af050864f96b20e03c

SHA1
5404f22d48e1af580d0923dfed73b8d5237097f1

SHA256
4f1bb356b146c2d459a3793fd9e9b2d79c7420013b4bb8f1c435773b44a3e01a

SHA512
5357ffed084d64fd10dcb9523a9c8b3f176d10787980195ab35f71eb4bf8380580f636f73efdae54acd0dc7338a42dae0e3819fe612548cb5b3200377be9f863

Download Submit
C:\Users\Admin\AppData\Local\Temp\EF71.tmp\EF72.tmp\EF73.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5ci6Cm7.exe

Filesize
87KB

MD5
de41e19902722935666e4b3d439d279e

SHA1
232f42e8719cf44634f124b3e4b3534a1731754b

SHA256
0d2b2c2d4f3c9b14ca227d51e135d6c5d6a4f014ad7d9401d629c72daeef46f0

SHA512
4d97745f2478aeb74265ff43528702a591f6f88ef6eeca279ad0cbc142319636738986516bb7415f5e4e61e169236c138cf97feb12e850787f2ba0fd89c5b966

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sn9jA91.exe

Filesize
738KB

MD5
c64805e6684b4a1ed2df2aa7369d4570

SHA1
be7ef85f78ebf9bc6e24a869f22b9c8d88a8fddf

SHA256
07af005f82050105cbaa7685ded57dc50777c768bf1df74f614259573d724e38

SHA512
d2cc179385015dadf0ffae450ea63bac8b81f51c2f31f35a7b4af00772ad50833efbc3c8e1f2788f7ac373d60bc6455adad5546cfc746bcdb5593be03e82883b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4wJ775Kj.exe

Filesize
339KB

MD5
33857b25f956d49ea42cdb19e52e9752

SHA1
7ca36bf415b33ab61012fef50cc4f2588e57eb0f

SHA256
f9a190b8e5a02d43a970a1dbe631f6edcbe3ddb9c4ea163f0eecd1a895e7cfaa

SHA512
ba03125ff5293edad2ba1416ebe0fbe329cd1e7bbf5383423600e8f30cd70111a2ff453e2dc0e5c4e539c1a18aa165eb457660c27c37003fd0a129662fcdc300

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gg0Mr52.exe

Filesize
503KB

MD5
8a41a1de42f0c015f8f51b69fcb28e17

SHA1
e55f6a67e1d0a21fc7b529dbf1e114bdc0002721

SHA256
29ac9b30938f4062db2b9930635d9a23cbf9579dc808ba044c797b4df720ad5e

SHA512
cc98eb44055796705beb7faf895ee5a1e0a936da3c49f080c5a3a6afe1a00587954814b8628cb764105c1d52850b056925d34cf9f7ba37ecf15775b1f273e998

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Fp53jU.exe

Filesize
148KB

MD5
6e20e6b39b2b0a22dd877fa3b813317c

SHA1
15310a1ed0e2a8b9442977ca4b2e1d3a30dbf733

SHA256
ad0135a8ad03cc13ca8cf2d785ebce7ec7f2331f1053846e7ea4479ec30a97b2

SHA512
ce7d26868eee5b7ed1e3c404427ae7600e48882b73a140a80f5eef03738c1bfe9f7973ba2e8625454aa7fc37824eb22dda4b97da3013dc1a5865a3d7e54e4c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SN8Us39.exe

Filesize
317KB

MD5
8b8e285daa79c4b98940904118efd88b

SHA1
c5c840c0fd05b59109788b7efda949644ca5c60d

SHA256
becc1f830480e1c2719fdfef9e8b29299bcd4e380188a6c8434b4102f00dd98c

SHA512
7a184475de1667e64265411897c1e8873071b4ca97ff3e0b0505e7c9bddb40b2427e5d251b3d3e9ffb0fed924b28ba5f9bb7c159b3644e99ef4caa51d4a3948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1dK35Zk7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Jp0041.exe

Filesize
298KB

MD5
4a071cc30292b81eb2350b5027cfde8f

SHA1
55825da08668fd0a1e197b75e6e42c7bbd99694f

SHA256
474f604ad90cb29cce321f4977f03a8144e99d8419e351de97e981e0db76d0a3

SHA512
2ab61f576810172f7671e7ed16c0f08e9802f16df843d543cf6ef600372ac715888b2822837766d8af8f61b7854acbef9d41b828500eb9d62184c496dc21e78a

Download Submit
memory/1868-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1868-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1868-195-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2696-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2696-29-0x0000000074080000-0x0000000074830000-memory.dmp

Filesize
7.7MB

Download
memory/2696-34-0x0000000074080000-0x0000000074830000-memory.dmp

Filesize
7.7MB

Download
memory/4196-50-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-59-0x0000000008A40000-0x0000000009058000-memory.dmp

Filesize
6.1MB

Download
memory/4196-53-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

Filesize
64KB

Download
memory/4196-52-0x00000000079A0000-0x0000000007A32000-memory.dmp

Filesize
584KB

Download
memory/4196-51-0x0000000007E70000-0x0000000008414000-memory.dmp

Filesize
5.6MB

Download
memory/4196-64-0x0000000007C50000-0x0000000007C9C000-memory.dmp

Filesize
304KB

Download
memory/4196-344-0x0000000073CF0000-0x00000000744A0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-345-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

Filesize
64KB

Download
memory/4196-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4196-58-0x0000000007A50000-0x0000000007A5A000-memory.dmp

Filesize
40KB

Download
memory/4196-63-0x0000000007CB0000-0x0000000007CEC000-memory.dmp

Filesize
240KB

Download
memory/4196-61-0x0000000007C20000-0x0000000007C32000-memory.dmp

Filesize
72KB

Download
memory/4196-60-0x0000000008420000-0x000000000852A000-memory.dmp

Filesize
1.0MB

Download
memory/4572-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4572-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4572-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4572-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download