mystic | 89cf09b0fd8a605cb966adaf3bb1cf0669e7e33a3cf8b3e8a97b9339f86983be

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe
Size

876KB
MD5

d18693c847c0a687ad43dbf77e7bbd86
SHA1

c9eee6ebcf13d30e314750739f3f6bea14c6d08c
SHA256

eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242
SHA512

a590ac6e6eb4dc231ae1196426f1d93586d564b63227f4dae47bac60c797ff2b7ac3f32f2f15c11eca8a141790fdb55321c2032a31341538c39643d04f2fd288
SSDEEP

24576:3yEp8OtG2I1+mTXyvcEiOMc+jx0D8R/tEG:CEpC1+mrT/OT+jxXR/a

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3484-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3484-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3484-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/3484-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/4648-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	5Gc6nD2.exe

Executes dropped EXE 8 IoCs

pid	Process
4928	Iy0US46.exe
2904	df4Ls45.exe
856	hz4CM94.exe
1672	1nn07Pg6.exe
2808	2OB0917.exe
2056	3rt10dH.exe
1644	4hE267lB.exe
2356	5Gc6nD2.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Iy0US46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	df4Ls45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hz4CM94.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 4832	1672	1nn07Pg6.exe	87
PID 2808 set thread context of 3484	2808	2OB0917.exe	93
PID 2056 set thread context of 2228	2056	3rt10dH.exe	100
PID 1644 set thread context of 4648	1644	4hE267lB.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2632	1672	WerFault.exe	85
3496	2808	WerFault.exe	91
4944	3484	WerFault.exe	93
3216	2056	WerFault.exe	98
3292	1644	WerFault.exe	103

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4832	AppLaunch.exe
4832	AppLaunch.exe
5064	msedge.exe
5064	msedge.exe
1196	msedge.exe
1196	msedge.exe
4732	msedge.exe
4732	msedge.exe
4156	msedge.exe
4156	msedge.exe
820	identity_helper.exe
820	identity_helper.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4928	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	81
PID 1124 wrote to memory of 4928	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	81
PID 1124 wrote to memory of 4928	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	81
PID 4928 wrote to memory of 2904	4928	Iy0US46.exe	83
PID 4928 wrote to memory of 2904	4928	Iy0US46.exe	83
PID 4928 wrote to memory of 2904	4928	Iy0US46.exe	83
PID 2904 wrote to memory of 856	2904	df4Ls45.exe	84
PID 2904 wrote to memory of 856	2904	df4Ls45.exe	84
PID 2904 wrote to memory of 856	2904	df4Ls45.exe	84
PID 856 wrote to memory of 1672	856	hz4CM94.exe	85
PID 856 wrote to memory of 1672	856	hz4CM94.exe	85
PID 856 wrote to memory of 1672	856	hz4CM94.exe	85
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 1672 wrote to memory of 4832	1672	1nn07Pg6.exe	87
PID 856 wrote to memory of 2808	856	hz4CM94.exe	91
PID 856 wrote to memory of 2808	856	hz4CM94.exe	91
PID 856 wrote to memory of 2808	856	hz4CM94.exe	91
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2808 wrote to memory of 3484	2808	2OB0917.exe	93
PID 2904 wrote to memory of 2056	2904	df4Ls45.exe	98
PID 2904 wrote to memory of 2056	2904	df4Ls45.exe	98
PID 2904 wrote to memory of 2056	2904	df4Ls45.exe	98
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 2056 wrote to memory of 2228	2056	3rt10dH.exe	100
PID 4928 wrote to memory of 1644	4928	Iy0US46.exe	103
PID 4928 wrote to memory of 1644	4928	Iy0US46.exe	103
PID 4928 wrote to memory of 1644	4928	Iy0US46.exe	103
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1644 wrote to memory of 4648	1644	4hE267lB.exe	105
PID 1124 wrote to memory of 2356	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	108
PID 1124 wrote to memory of 2356	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	108
PID 1124 wrote to memory of 2356	1124	eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe	108
PID 2356 wrote to memory of 1764	2356	5Gc6nD2.exe	109
PID 2356 wrote to memory of 1764	2356	5Gc6nD2.exe	109
PID 1764 wrote to memory of 4080	1764	cmd.exe	112
PID 1764 wrote to memory of 4080	1764	cmd.exe	112
PID 4080 wrote to memory of 3992	4080	msedge.exe	113
PID 4080 wrote to memory of 3992	4080	msedge.exe	113
PID 1764 wrote to memory of 1196	1764	cmd.exe	114
PID 1764 wrote to memory of 1196	1764	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe
"C:\Users\Admin\AppData\Local\Temp\eed45d9e5d96aeb74fe1cc69021711612a369fda742046e59c00a9515de1e242.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iy0US46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iy0US46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\df4Ls45.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\df4Ls45.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hz4CM94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hz4CM94.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nn07Pg6.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nn07Pg6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 580
        6⤵
        Program crash
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2OB0917.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2OB0917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 540
        7⤵
        Program crash
        
        PID:4944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 136
        6⤵
        Program crash
        
        PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rt10dH.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rt10dH.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:2228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 140
        5⤵
        Program crash
        
        PID:3216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4hE267lB.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4hE267lB.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 136
      4⤵
      Program crash
      PID:3292
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gc6nD2.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gc6nD2.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\95C8.tmp\95C9.tmp\95CA.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gc6nD2.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa67ce46f8,0x7ffa67ce4708,0x7ffa67ce4718
        5⤵
        
        PID:3992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3933863706401150271,16745368990365184866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3933863706401150271,16745368990365184866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa67ce46f8,0x7ffa67ce4708,0x7ffa67ce4718
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        5⤵
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
        5⤵
        
        PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:3708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        
        PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5780 /prefetch:8
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        5⤵
        
        PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12967192230621647423,13475439880495672803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa67ce46f8,0x7ffa67ce4708,0x7ffa67ce4718
        5⤵
        
        PID:3096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2241655222984163208,15530578093564473149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1672 -ip 1672
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2808 -ip 2808
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3484 -ip 3484
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2056 -ip 2056
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1644 -ip 1644
1⤵
PID:792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d120164fc267f2a57e51b5e765095e1b

SHA1
ba1ad588d8f939555f55c78feae3adf9b5e96c7b

SHA256
85304264166fbe169d4f337d2a7f782621aca7c2678a621af871b26849a06a17

SHA512
0e45763f1151e038bc34e5779ffcfbf16f23220b96d450fce52b177b5d49a571c7963d614e796339f4b30ed09245396b55539d7168d9a74a4fcf82866d1025bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
885f97a889f02e3414651ab581430ee9

SHA1
e41ff315bc1f95720f8544597a2e434b0e2f0431

SHA256
1a702d3070cc519ba79facbdc969bea30ee41d3da5652e7bf538b08998fc3357

SHA512
65c7946560a9fd587d7b316689ceb22517432a521a1a7513f4c2b95fc6a8df2ff0850fe5b3c62d043a6526e0df49bf5af08d4724d76ebc12d1fb0415296fcb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fcd9718d40a437d9c822a6244e2ab34f

SHA1
f965df00941d5e647829a9441541b81f010599cc

SHA256
852c48f83193169edffb98e7e7f3834587fd8e813916a94b65f6639b92325284

SHA512
f212fc623a89a30fbfce66168c54de5a72eb93ef3f572a6238fe0399ad120d4a901632087e16b2cdaf26c8e3a716600c131f6c6e68c3c2bb196fb36516ecff38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
89bdcee269555e5ed25521747bd87857

SHA1
49fcf7c229d862bb33eb904a13f2f7bb5a1ecb15

SHA256
29154b2a1458c682e670c39aee7897cf363c25ed0e8b4806b28356a281fae69f

SHA512
cb4429895e483caa988cd9e75cfbb54d29b4d0a2a5326cf7ad33990a35a68f7e04a304eb3ece188571d993cb925316a1128eeeecaaa2fee7809703da61ddffb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6df37e9e96761a436bff8274dd74c896

SHA1
09a793dd07cd835e1613917a83d5c1cfd80372ba

SHA256
971e59308794008c8ee2001e7e678859e04fab7f912b055de640e6b32c6a7e09

SHA512
569a45aae175ad21f2927d880042364a95baf13a7dccb52de2184c3a420d7c8abb28dec7d5a93bcae5b7826614aebd314dd90148e0ba85cc65457ca967334a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
e53cd99ca4b786f6f9986e167b079cd2

SHA1
f7a1a14492587a0fd3c8475b914503fac110b305

SHA256
d0eb1b4821073e90f49de0e873adad63d0ded815278ae6580666a65b4480816f

SHA512
3dc4a7c5bc9fd703baa4ffd8effed8cc27ea4bb6567b2773045326e29ca9a137a24dbce6459ff3ec61d76c3d613cc2397ec7c5b4fb7df65b17032aa4ef812fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
1c9f107a9ddd430efebbbe66e8cdba0a

SHA1
159da7b13d3cff7ed52f81063a1c642a802ccd3e

SHA256
2d8e983354fc6650fdb5942127b6995bd58a9c40cc837127eac48b96d8a90be6

SHA512
6e27e2164a17a787ef77463ea1691cb410a3d090f1007b74a0a0d70760415df5e1f1e1548a1cc833795bab0576b51465b129624a328e50fa0b442c07ecb3faef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
85fcffe49d59cfb7e55eebb0dcc414ed

SHA1
1d656d82eef4c86544674ec291dcc5029668319d

SHA256
416f2b441794a94c5c6107e3ad6f18451b34a080620bf411110a35a5df149b2d

SHA512
de1650783cf5562614c7f72b0c3c3e7425c9b63f698b258f37b4ff3a73b525446c6e458ae9a92244e676162faadf7cf6a1438d68bf749bdabed8755b511bb3a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b0fbf2a28d1a7f2c2b52f124c2b0e943

SHA1
325afd45bf53716b7102d5d19932d6c4324ee718

SHA256
8e0915b77ada00a8afb4a77808f3762d0b0fdc203c56a7943f762a67339a6b83

SHA512
a9c946520c8e3fc03e6f8f91f487127c9a0eb51263f9539a7de0405f1577492fddc3cb781920035dda8259771cf642826a59c2497441e25befa3fcd4d79f8d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5807bb.TMP

Filesize
48B

MD5
4fcf9a14d29cf8c3302306d6955001e2

SHA1
7cf05f0e56fc2e1ed31e5f84c7e07b8973547530

SHA256
7b5ec964ba9d11bb30dcc8a74a69b11d2497bbc3eb2062c1eecf119d7de964fb

SHA512
2a0c43edddcc488fd9751298c3468245ad61ee0687e9f21105df5615a3f1186fc3da47e1abb4de4be7ed3b1a667cf1c0da3b02403148309b1c4e1152afe50ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
10f1f80fa1059a15c1bf6d033e40d208

SHA1
8be7d7d70c2f7203db4bfea752e7839ac9c1421b

SHA256
c9af956ebc58443cefd5db22656c157d1687347a42c5c0bc97efaa6694d081be

SHA512
d7fdf5e2eb5cc99ffb3ee8fa85378d18dd6b98c03d0245804dc3e1f4fbf2e4c7a78703cc6c94f18d5c484781a3825c18b56db888ad53225672ec433aa2e3bf3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f6f29eb311b698378d47ae88d0ebeaf

SHA1
1f8091ed7f17b426a3b9a4781701215759d94ef9

SHA256
333e4bffc581d6fd3d6f13107a355707e6623bed02f68f865d862284b0b1b8d1

SHA512
a28fa15c4f639cf52fa0767947e09cdc52d8db2f568cfb2f1bce0b6ea5b059e28c08d1a340cc4910fcb1631a564fd24bf18917e84782790f535632d3e75ba3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a19a628bcb409ccdf7a4dc96e53a0ab

SHA1
75bc9f78c124ba64112eef1229cf2ea9f23f512d

SHA256
73b8b40afc674ae2de38a69a67ff610bab85ad5e617be10efcef8646e2d22eb1

SHA512
8b5888372cc69f90d3fbd64bc4e7d6aa2fec7dfd01fafc082034dfd0b4585600b05340b85f42d331a313136c02c0fd650c3e2593240cf3248a78d2b126e6d9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ffdc.TMP

Filesize
1KB

MD5
7782aa33e729ee49fa4f219d00dbf051

SHA1
d44784f5f0135cb5f657a01c5b48cf1ea19b888c

SHA256
5052c9e2fff612ef1727aa31403d57535924853eef6604f7d29be08e23d0ade2

SHA512
238700dce89a819b489f82bbe3efcbfcaf9552eb3de4e46cf417345c77676c9524778d6bb44ec48a8600c643fb6365bf2fa4e388498f4d5a0226f703cc539761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8ea79b458f7700631643acaab9639a2b

SHA1
5cfba53fb7af4384c7f22aca0deca86f7431b901

SHA256
5634a1681e9ddac669b94250ea1b7be84bfbf1818f8636932c9f1a5e61697faa

SHA512
12207417915eddbcd5d5d6f74f46f52d3ccc71ff87c358c70a87641dbc858f87b9507e440eb243a7374f0b2dd21b3939b778c3303ae7ae272f621ee21e4b506d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c076ba8fdda27e972856cf055d28884e

SHA1
575f90f530d8929179aeed5a2448ef9aa76c4df9

SHA256
6e28097aea4d0c498d70732a7bdca265e8d245f714c7a554f48bafde7e6d8327

SHA512
1d53125843bae7638e9158dfac9eb7ba92c8994e9b19fe59ef7e92e77d00c9ebfeb33348eb67434e0c1492800d12690c4c1a33889a7f10b8da805b69b0d6cc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d77ba526090fd508331af876fc01eac4

SHA1
0b75c94315cb28e26bf6cff63f061218edebe2fb

SHA256
e8662a71a8dc5330550cfa3230c29b63329b2597006644a534ec1e0957937473

SHA512
840f8e6994558640850b27244806b554a27539430fd620bc13b52dec731460e7cc3009caa9cf07899fd24eeafab44a143f0d6a2e00784276d054c0d0a9de0643

Download Submit
C:\Users\Admin\AppData\Local\Temp\95C8.tmp\95C9.tmp\95CA.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Gc6nD2.exe

Filesize
87KB

MD5
841376cb5f7af6bed41294de3fde0730

SHA1
a25aea5192905446e2189d7c2a95ee7d9b0cdd72

SHA256
8acc9b97eb5dbfc0133ffe409f57699329c2c20a0342430770897c34310cc838

SHA512
298f9ff0b71987c26dabcee00e9c43b664e3f42927d6e7acdc54bbc9639f7b916660f58a7b1821a9f763a089a21ada9f0bbefa137bac90074397aa89c8c1ff05

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iy0US46.exe

Filesize
738KB

MD5
ad0bd02752f87dfd33607929d1b2558a

SHA1
4f7f5098dbe4658e7fb5dc85b29705d18f0bcf7f

SHA256
5ff91ae6a9740fd11411a520a2c797eec68e04e087501b5962daaddf4d0bce10

SHA512
021d47d5636f7b24063583a645f47378b8bed2a75e75b2de4924e8cccb5f25ffeb2ea7106eb1e535615c41b36312f468e9219349e40c74ccd74736ff89aa2a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4hE267lB.exe

Filesize
339KB

MD5
2408c64a47c99b5f6ab93fb7518b5ad0

SHA1
16cc5133859c865b4e21e421ded218032052d863

SHA256
2b273a8e61ac8ffadda7779ceaae1ea7aeb35ef576dc6f9e17dc397f68b534f7

SHA512
c2943d8d53cdc87b8f6af556821a09ced0a58b21dec401924bd962d35c1cdab589ce99e03a99b6e5422b236e70b14893d023bf63d83dd0f6849ef6ce8dfbb024

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\df4Ls45.exe

Filesize
502KB

MD5
7da62989f10087f1b55e5193eb47b757

SHA1
81b01d57875813c53ec8b8a0b3fc80705d51e92d

SHA256
de52ff6c5d04987636214e86dde8ecf21944b91748df64fbf134ac613a3b7fa9

SHA512
e20c25718814726ec8d3853e1a7a49e45cf1781cb89e94757dbf6253c2ee205e1be303fa452ab23958da53795d3fc0464272cbca3c5388e9d1de018f1e42cfde

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rt10dH.exe

Filesize
148KB

MD5
95dc1a3bbda4741683d400839d86cfe0

SHA1
d7e514373ae8f00e84a299bdcbbf65da6725820e

SHA256
a9ba88eba6e30e888144b4893cdbc0034caaefca9a74afab9a7b7249ea52e358

SHA512
55e7249c142a7bb2760eefd7375a8a748742f047952697edf9ca860de3ddc384d3c83129c793f6da3ba13bfdab1cd9ab7843b3147467b9d78328d4b8033e28e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hz4CM94.exe

Filesize
317KB

MD5
89c72f2ba8d1e8a1452f8892efc8fca1

SHA1
a1c6c15be5d746ba4a2ec641658fa83a31c0f8ab

SHA256
42423a58105a3ee266721ea3499ea7f301c21a6a767787f8eb96e1897a7bc7b8

SHA512
23d6b7b7ee3b12024e5fbd0626c1d266d49f6f5506f2f3980b1d5b3d031c0abad096fd105ca740f5b138e1d290bc3378ca3ffcadb9f13fca9178425d8a40d0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1nn07Pg6.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2OB0917.exe

Filesize
298KB

MD5
1bf4eac726c42f2b0cdae339d939a3fe

SHA1
93f84ad35165f0dab27031b6efdd798f0ea22294

SHA256
a1bf2975070a6c9392bc4faf536fef809d80f17e76cb092c9a24a79f5a3a006d

SHA512
4fb116df88d5484210aa87d7626b9ab19517aaa04a0f97d6b3331fd715723b966cc40fc10ff94d525bfaa0f84022000ccf03fe4d48f3661d4f9992606f1c0f9a

Download Submit
memory/2228-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2228-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3484-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3484-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3484-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3484-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4648-58-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

Filesize
40KB

Download
memory/4648-360-0x0000000007CC0000-0x0000000007CD0000-memory.dmp

Filesize
64KB

Download
memory/4648-52-0x0000000007B10000-0x0000000007BA2000-memory.dmp

Filesize
584KB

Download
memory/4648-51-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/4648-50-0x0000000007FE0000-0x0000000008584000-memory.dmp

Filesize
5.6MB

Download
memory/4648-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-359-0x0000000073EA0000-0x0000000074650000-memory.dmp

Filesize
7.7MB

Download
memory/4648-53-0x0000000007CC0000-0x0000000007CD0000-memory.dmp

Filesize
64KB

Download
memory/4648-64-0x0000000007E40000-0x0000000007E8C000-memory.dmp

Filesize
304KB

Download
memory/4648-59-0x0000000008BB0000-0x00000000091C8000-memory.dmp

Filesize
6.1MB

Download
memory/4648-60-0x0000000007ED0000-0x0000000007FDA000-memory.dmp

Filesize
1.0MB

Download
memory/4648-61-0x0000000007CA0000-0x0000000007CB2000-memory.dmp

Filesize
72KB

Download
memory/4648-62-0x0000000007E00000-0x0000000007E3C000-memory.dmp

Filesize
240KB

Download
memory/4832-34-0x0000000074240000-0x00000000749F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-29-0x0000000074240000-0x00000000749F0000-memory.dmp

Filesize
7.7MB

Download
memory/4832-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download