mystic | c741e309cca1439b9dde1d6c5ad9678582165daf6370aaf4c13c05cf36441cd2

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe
Size

882KB
MD5

c2874e64dc4a713e5f1a394c132d9382
SHA1

f8e8f6448660d3bde3affda3a4534e24d2bd6074
SHA256

41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975
SHA512

95c339e5bab30ea79de68e97ab6ea06cc0520807610bcf9b25267b8150b718078b28243a5347e51ad89f09fc736bd35cb077222b576992e6361b64b7ec316b45
SSDEEP

12288:tMr1y90Jd4rJMuNnRX3l8dI2YcKoPLByw4yNkz1sLw1m5pPT4zVyc8kvjRMbHaCE:oy44plHolDkz1AIeCzAc9yJIixO+8

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/808-33-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/808-34-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/808-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/808-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2336-46-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	5Jb8fK7.exe

Executes dropped EXE 8 IoCs

pid	Process
4536	eR7cC46.exe
1620	NH5Jt10.exe
2012	VH4zj36.exe
2884	1PV08BV7.exe
1236	2Re2210.exe
3120	3gY89Th.exe
4936	4Sw518nV.exe
1484	5Jb8fK7.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	eR7cC46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	NH5Jt10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	VH4zj36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 2476	2884	1PV08BV7.exe	93
PID 1236 set thread context of 808	1236	2Re2210.exe	100
PID 3120 set thread context of 4364	3120	3gY89Th.exe	109
PID 4936 set thread context of 2336	4936	4Sw518nV.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
436	2884	WerFault.exe	92
664	1236	WerFault.exe	98
640	808	WerFault.exe	100
2552	3120	WerFault.exe	105
4408	4936	WerFault.exe	113

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2476	AppLaunch.exe
2476	AppLaunch.exe
2604	msedge.exe
2604	msedge.exe
4756	msedge.exe
4756	msedge.exe
1176	msedge.exe
1176	msedge.exe
2832	msedge.exe
2832	msedge.exe
5504	identity_helper.exe
5504	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4536	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	88
PID 1476 wrote to memory of 4536	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	88
PID 1476 wrote to memory of 4536	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	88
PID 4536 wrote to memory of 1620	4536	eR7cC46.exe	89
PID 4536 wrote to memory of 1620	4536	eR7cC46.exe	89
PID 4536 wrote to memory of 1620	4536	eR7cC46.exe	89
PID 1620 wrote to memory of 2012	1620	NH5Jt10.exe	90
PID 1620 wrote to memory of 2012	1620	NH5Jt10.exe	90
PID 1620 wrote to memory of 2012	1620	NH5Jt10.exe	90
PID 2012 wrote to memory of 2884	2012	VH4zj36.exe	92
PID 2012 wrote to memory of 2884	2012	VH4zj36.exe	92
PID 2012 wrote to memory of 2884	2012	VH4zj36.exe	92
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2884 wrote to memory of 2476	2884	1PV08BV7.exe	93
PID 2012 wrote to memory of 1236	2012	VH4zj36.exe	98
PID 2012 wrote to memory of 1236	2012	VH4zj36.exe	98
PID 2012 wrote to memory of 1236	2012	VH4zj36.exe	98
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1236 wrote to memory of 808	1236	2Re2210.exe	100
PID 1620 wrote to memory of 3120	1620	NH5Jt10.exe	105
PID 1620 wrote to memory of 3120	1620	NH5Jt10.exe	105
PID 1620 wrote to memory of 3120	1620	NH5Jt10.exe	105
PID 3120 wrote to memory of 2604	3120	3gY89Th.exe	107
PID 3120 wrote to memory of 2604	3120	3gY89Th.exe	107
PID 3120 wrote to memory of 2604	3120	3gY89Th.exe	107
PID 3120 wrote to memory of 5100	3120	3gY89Th.exe	108
PID 3120 wrote to memory of 5100	3120	3gY89Th.exe	108
PID 3120 wrote to memory of 5100	3120	3gY89Th.exe	108
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 3120 wrote to memory of 4364	3120	3gY89Th.exe	109
PID 4536 wrote to memory of 4936	4536	eR7cC46.exe	113
PID 4536 wrote to memory of 4936	4536	eR7cC46.exe	113
PID 4536 wrote to memory of 4936	4536	eR7cC46.exe	113
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 4936 wrote to memory of 2336	4936	4Sw518nV.exe	115
PID 1476 wrote to memory of 1484	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	118
PID 1476 wrote to memory of 1484	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	118
PID 1476 wrote to memory of 1484	1476	41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe	118
PID 1484 wrote to memory of 4416	1484	5Jb8fK7.exe	119
PID 1484 wrote to memory of 4416	1484	5Jb8fK7.exe	119

C:\Users\Admin\AppData\Local\Temp\41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe
"C:\Users\Admin\AppData\Local\Temp\41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 552
        6⤵
        Program crash
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 540
        7⤵
        Program crash
        
        PID:640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 592
        6⤵
        Program crash
        
        PID:664
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2604
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:5100
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:4364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 140
        5⤵
        Program crash
        
        PID:2552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 136
      4⤵
      Program crash
      PID:4408
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8AFA.tmp\8AFB.tmp\8AFC.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe"
    3⤵
    PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff851b346f8,0x7ff851b34708,0x7ff851b34718
        5⤵
        
        PID:424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14762657868969597225,14156298600743487678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        5⤵
        
        PID:1488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14762657868969597225,14156298600743487678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff851b346f8,0x7ff851b34708,0x7ff851b34718
        5⤵
        
        PID:4512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:3084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
        5⤵
        
        PID:3028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3524 /prefetch:8
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
        5⤵
        
        PID:3956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
        5⤵
        
        PID:5184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
        5⤵
        
        PID:5168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
        5⤵
        
        PID:4988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
        5⤵
        
        PID:4588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1494668694572295538,7166702895086500332,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff851b346f8,0x7ff851b34708,0x7ff851b34718
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,14409771908102238436,10794229662566766958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2884 -ip 2884
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1236 -ip 1236
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 808 -ip 808
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3120 -ip 3120
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4936 -ip 4936
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a4352e2a9182f617d9b9ceccedaf03b9

SHA1
7a77423801e931e27a4a714336a9eb83105ba1c0

SHA256
5ea7ff4fd313c5de121b91668fdd26078c52f22f75299275a7835b23eecf671b

SHA512
736ad90e612f116dd2cf5517e543b733b43c7d408812d8ec05c0ede155ea69824d1054143e30305c5747a6aa5ff5493c9092f71b411ede64b31610725d0e5159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5492705d1c9f153a38da2898e7147f72

SHA1
53c569454e965ae32133f844294ae6c1f1923a0a

SHA256
ed63f3e8290fb48099a83d13c7aa1f53131176889d56163f48696096f7df5cfe

SHA512
d079025d55dd7a68e3815f2012bd811a1fe3717535964298faeb5db0244d1ce5cdddc3455339b22165da10239f94565afa72600888b8bff36380d6483a97e001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c5d96ee88a3b05b6d6bfb634cf7e0bb8

SHA1
8537cc8676ed1eb77ac5354793e9b050ee536709

SHA256
9c4cc4b91b0ee939bb0b4896a99a551c5dcf0d0cf07e297c8a3731653de9f6bb

SHA512
1e63c41a99bf1a58bee1018edf5aeb5f750ea223800319d996a59cbac35e6ea77d1104282238a7425c3288c1aaeb886c17bfdc24ec8a2e28878e6ae7d21b981d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d060133d1d733ac9c17482b07e0e85f0

SHA1
dabe1a0f60456016dee881076274e46c1f89821c

SHA256
71f64deddaf08be6e15ca87baead94d0ea4a8643344f88ffab87b903d59a64e1

SHA512
d83722e58ab7c08cff71d6c233504a1288ee28282ff18b1a32f53b91fed8ee71a57adef2c9529469a21b88298e136eedb327747b3b0f3dafe3914fc77ffe42a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3779649f7dd67d96c6e686aa593c8adf

SHA1
040f4649e5da27f8e7f15715def967ec4ce64509

SHA256
7164dd049ffa9c423a95fdbe4bb68d44373638eec3d5ef6a8d2ed5d41630f737

SHA512
4f304e0624b1cdf4ddbb8cf68bf978f5844af27ce7724719c50ee999e50ace6d1c85983ae313dd168af3c61bab40310557d03b259ac55918112eee7a2020b145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
048a88f63eeeb4d64f25b2f44e37022f

SHA1
d8f56f8f83fade76cdd21ae34716fe7558805553

SHA256
1a39f2e962757b4e19f0219cbc3169170a289e570f38b9b13d35c88fdb419c83

SHA512
6d251d88941805830d9955bd6a341c87b97fbb38c4ea5616caa464a838cece6f18ebef674dce28e6a192d31e2a41c63fc52df7237671d84b44d3f5968cb29a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
b1df86ba768a144560422d27154d39d1

SHA1
544483d5002967539cd3c04107a58ccccd22c389

SHA256
ab56a922c5e70b6905ca050c2ed5c9b0d89fd4c688488d4d8b27cedacf3621cd

SHA512
c672c28539f2abc23d236b190ff8530fe5bf505694e672ee93e40d6c8c21df057fb71e4807634f2bc7f714df5e8788cd06264204dc95547dbdde79b9554a5e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3ed6349866f54b3732bec2b78b88bc95

SHA1
714c02764defbcfdfa414cda2b5b9ee9323ad036

SHA256
9144cc7466fd05834ad458b7620dc4bdca4aa4a0457088781e7d6cb409de28a1

SHA512
1c2fb41fde1be0fd03c4ab8878e75b370e4dadc46a6861e53d41d92a4722d9f991678847b1ac33dc48cd300c4ca62e28fbd346fbd02ba90c9f8770eb0b7c1dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
97721113e86cbdc764c4e55a7e130fc4

SHA1
8eedc2c86f747971cae25f914e441c177a94b774

SHA256
9345799090eb5b519e3b01675d5ab756cfcbe606cfdd51e41d3ffb15f093c5da

SHA512
55ab291cf303c44faf487234c76967491d6c51952485b3d3c7a627920f9f6c41864d1a520293f4ac4b9b04c95a59bb31a9338644b1ae580c684c8efc3906cffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fc13.TMP

Filesize
48B

MD5
4faa8c5d45ad5daa841bbcf351d01c79

SHA1
838fc2452f95261c322a42085d46ce530ec7ebd5

SHA256
71d2f0372bb75b15780c2781a531a3dd76dd3dbcea164bc44f86f974199035dd

SHA512
858e004f34ecfed3f241660b275a414faf555d230afc8993d074d11d61f53275c67363af626f0b937f42216339cab4dd6b641984724e8c1236fdd4caf10a2016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d064b62b217cf27ddd44a03e7f86df0d

SHA1
0977f70e18792265e2173221f31bec264af7b20c

SHA256
2a2888c71b87f011e53eddf74a324f13ed42480d5c0cf5326b41d5776b6a7ff6

SHA512
0b14a991f167f71cab326477e6f0853eb1df6a2c27f886355ed1856771edb62b40361c3c02edcbd3f356b75a4c684995055d1ae100a4bed3c236f96969ba8307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
13347cf36dafbcf21489558d7ce00ce2

SHA1
5827527a74aa33bd3691570fa37f020fd3726fd3

SHA256
8dfc0d05d47a67de717924dc268a9d8303226c07a5257b3e737bfd6692bec423

SHA512
9a24796465dbc1c751655de430abad4953c2ca7e50fd4bb92a35fcc19f92d0f34dd7745925b33de60cd837528338f145c47eb7089e6707239e9d961f9643ea3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d4a679718f79934912efe62a9c5b1b20

SHA1
b075e51b4db72e24bab6ebf65b8ecfd49133f400

SHA256
9e13ccb2e32901b98ac2155cad4ffef001bbc23bff316ad690912e98535ee9b7

SHA512
a012b2710ff1c979d6c15429f175d0ebbe24d87671318614982b52057749f4e4d00ee312a4bc91de8553ec2afd4c78525512ba484d0c949dc13ecf364185c149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7e46a5e557985f7912e2789e5fc339e

SHA1
c906ba80e4fa46e59859e553ebb4c129fc74d4fa

SHA256
333c79f3fb052a7dc8af34e9e94a0afe6b4fae76f30b2dcc053080d46c0afb6d

SHA512
30f93fc20faab74a54ae6eeb64ad5bd508788a7ed067b37a14408d5089462b89e5ba94fefc3dbd5c7a62a09671ff8e9bf58568fc651a9b211f37050883db588f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f81b.TMP

Filesize
1KB

MD5
03849cca6e35ebd156ce8ea65825ec38

SHA1
4823bd64d23922f398c6dc628eb0a9843b3f1e4d

SHA256
047345b9f257147179470e9576f7377ebf500e0cb607440150cfd79856e5ed07

SHA512
33f30dbfd6cd37e7fc6bc86cca27997b6d4f67d8bb3e92f86cfca58ade43bf4b1ba77fddf13836a8f0fa4727646ae035b9160afe85f46b07bd08b3664b7be1cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cf0914a25e85ea92963e2dcd6862df9

SHA1
2fd99e6fcbf357aabfc0ee7a211d74f77d1f5798

SHA256
03f6a4e54c75177390076416503cbe6723859c688f1d4eb6e1c169eb8e0d6374

SHA512
45a287d62925c410bdeda5c6062a81cf1cfbe28cb9edfc05deba2131d11a1b8ee3d334091ae7c2ac8365609952ed1f1db90a2d965da9480e4ac7d36874984485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6b500d399ebe91e5a533b77e5f89aba4

SHA1
901ee716e78d89848c1aa7137987e704e484d9fa

SHA256
9f680516fbfdea3366138e69d0a032cdf6987d010199447e7ed53abf06611b65

SHA512
f71f0bf6a268c2eb86f74300c15f88f68ce78a069940a27f48a8d9098f5d64795bd568a16e5cdddc07c3521df3f4e19f6b771330363bf4b763f2c0a60b7a058b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5e5147d3e84e1f495ef52e1a573af4aa

SHA1
dab5142438b10b3c155b8cd8f4aa5e7a61a74752

SHA256
8ea1bf9057644960b0440c152d14b9b13772ffda215ad63c031a0245c9174823

SHA512
3aa33a9da2916461102a1e870ecbec101c2834592249f6be393d51e968dfdcb4045f91bb266ad55ed29c0aecd64c36d992e09614ac92c77695a06367f6df2f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp\8AFB.tmp\8AFC.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Jb8fK7.exe

Filesize
87KB

MD5
949cbec3b3037780fbcf68b41a82fe60

SHA1
2f836ee237ffb57daf8d5dfff0461a1d65b4b672

SHA256
36cbd02759f14d89ab98129f5568effa2e7d10b7b9ceb8f174e4aaafd8fbc8c3

SHA512
facf34694cc2dad67b73cc7f6ba854deba1356c121f84490bc00106f349814418650522e49e3b4a9ddcee4ac6a4c06b453028ccf9dce65921a04d421c34c923e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eR7cC46.exe

Filesize
742KB

MD5
1c72cf4e68143e9563b613c8948873fc

SHA1
ec5ed7fd64b5b2849317f8c9014bfb706db860d7

SHA256
b7e5e3d078bcea0202418040de2234147d9f30ad195320677f36fa09ce6e8829

SHA512
0fc3209463dada372dc2f91473848d56371f1877b92543dd4b0d92d05d419d57e5f33fd24eed8462338303852647c25dd825edd36a1feb14897998bd0d530251

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Sw518nV.exe

Filesize
336KB

MD5
cc40d1fd09946625e7b9a8b39115e019

SHA1
48487fed757a58e76c7bf8948a1e5114de85cd2c

SHA256
3bdd4e656c4cf13ca8ecde337887d6ff65566b117dfc37413ac9b412be60a17c

SHA512
48dad8fe2f06c50aa49e5b8c483b2a955f81a6599b0b1281fb29a4bbc1690a8d4c1c78320dbac36c9550afbcc288d043370c6045d51ac77b8cb4e0e437a65bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\NH5Jt10.exe

Filesize
508KB

MD5
522091f101a94de136e66d69be30e14f

SHA1
e087bc9561aea26fc0612d2c02540692cb51d312

SHA256
36c8c1bd5a2a065ca10b6ec7db47fafec37aae4cec85a358905be8177588fe43

SHA512
65516d8d40c419d08014d68828010e53278ad8442db6d3090fd33946b5869de00b933fa2c9f155031b303cf0008c07506bc03fe60b70918633d059a15223b8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gY89Th.exe

Filesize
145KB

MD5
ce3b6a20db18d730a3706a0d4c9e3a67

SHA1
200fff6de835d17f8e240b16226d7e79f1c58eab

SHA256
8f9e23a3acbad41d00e4521368b32db5a801611914f2217088bbe2ee379e3775

SHA512
533e2604545d2a0a6d8f69f83b1c06400416c3618b5ce68050c96c4384ead04558594958a1128d67ed6683585528a8b67f418f7efc0d583568bf2f547bfab2ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VH4zj36.exe

Filesize
324KB

MD5
597c5108f287f50f7c2cdc8c9b4ee0b9

SHA1
9840c5ec7759f9d39832183a196828df83665c97

SHA256
a8ac4275228bdbd18e96161c17aa38551f4748db6ff650997fc5c44095ec608b

SHA512
4d9e41761bc272030001f8176546683b66e444ea24d4ec2f807ef07ff039409769d270eb042a647348d4bd1149f25e0870ba2c4f002d4861f7ab483af308eade

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PV08BV7.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Re2210.exe

Filesize
295KB

MD5
e5b62ebfb765fb5276bd60ac1160cf42

SHA1
2ae5b0b91d341d092180314b7c6bfa5c53e367b7

SHA256
c70ba80942dad9cddb5fa849b84f3d38fe1b5426dca1e0329d491cb4367f55c6

SHA512
5ac3fc6c3f874a84660d373fe1c89f922daaf43eeb794ec2d6998c0823ce81f8c5ec802392b48a715c27bb737c23edf0c4311f6e4f93bcbc7ab577df943d8af3

Download Submit
memory/808-33-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/808-34-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/808-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/808-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2336-59-0x0000000007410000-0x000000000744C000-memory.dmp

Filesize
240KB

Download
memory/2336-50-0x0000000007460000-0x0000000007470000-memory.dmp

Filesize
64KB

Download
memory/2336-60-0x0000000007470000-0x00000000074BC000-memory.dmp

Filesize
304KB

Download
memory/2336-58-0x00000000073B0000-0x00000000073C2000-memory.dmp

Filesize
72KB

Download
memory/2336-57-0x0000000007DD0000-0x0000000007EDA000-memory.dmp

Filesize
1.0MB

Download
memory/2336-56-0x00000000083F0000-0x0000000008A08000-memory.dmp

Filesize
6.1MB

Download
memory/2336-349-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2336-350-0x0000000007460000-0x0000000007470000-memory.dmp

Filesize
64KB

Download
memory/2336-51-0x00000000047C0000-0x00000000047CA000-memory.dmp

Filesize
40KB

Download
memory/2336-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-49-0x0000000007310000-0x00000000073A2000-memory.dmp

Filesize
584KB

Download
memory/2336-48-0x0000000007820000-0x0000000007DC4000-memory.dmp

Filesize
5.6MB

Download
memory/2336-47-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2476-260-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2476-29-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/2476-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4364-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4364-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download