mystic | ea35b3cc99e1d500fd51a89c170af5dcde4a67f5302a34bf438e37168a79b0ea

Analysis

max time kernel
160s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe
Size

877KB
MD5

5cf30590c99aa762134358dc148a27e5
SHA1

627a0b97c6c2964ac518879412c2773efc191da7
SHA256

f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca
SHA512

223f35d9740e8b7b6e19937b739f61df4ad5f1de38b7e56914eabf58df0450d763bb1c8aea90a11d95374adff6a02cc374603a5fcdc30a99385adff0bdec7a6d
SSDEEP

24576:xyzeIH1htQ79fKIFTycY6wlt608PheVQZxN:kzeShg9fK2nwewK7

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4700-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4700-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4700-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/4700-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/808-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

5uB4gS1.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation 5uB4gS1.exe
Executes dropped EXE 8 IoCs

Processes:

JE9PA13.exeIT5cZ21.exeha4Bj68.exe1Px39ut7.exe2FO0840.exe3CE08DX.exe4Ic616YF.exe5uB4gS1.exe

pid process

3040 JE9PA13.exe
4048 IT5cZ21.exe
2708 ha4Bj68.exe
4044 1Px39ut7.exe
4844 2FO0840.exe
3496 3CE08DX.exe
1156 4Ic616YF.exe
4724 5uB4gS1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	5uB4gS1.exe

pid	process
3040	JE9PA13.exe
4048	IT5cZ21.exe
2708	ha4Bj68.exe
4044	1Px39ut7.exe
4844	2FO0840.exe
3496	3CE08DX.exe
1156	4Ic616YF.exe
4724	5uB4gS1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exeJE9PA13.exeIT5cZ21.exeha4Bj68.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	JE9PA13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	IT5cZ21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	ha4Bj68.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1Px39ut7.exe2FO0840.exe3CE08DX.exe4Ic616YF.exe

description	pid	process	target process
PID 4044 set thread context of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4844 set thread context of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 3496 set thread context of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 1156 set thread context of 808	1156	4Ic616YF.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3388	4044	WerFault.exe	1Px39ut7.exe
656	4844	WerFault.exe	2FO0840.exe
2508	4700	WerFault.exe	AppLaunch.exe
4800	3496	WerFault.exe	3CE08DX.exe
1388	1156	WerFault.exe	4Ic616YF.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

AppLaunch.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4908	AppLaunch.exe
4908	AppLaunch.exe
4900	msedge.exe
4900	msedge.exe
872	msedge.exe
872	msedge.exe
3636	msedge.exe
3636	msedge.exe
2372	msedge.exe
2372	msedge.exe
1256	identity_helper.exe
1256	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4908 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4908	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exeJE9PA13.exeIT5cZ21.exeha4Bj68.exe1Px39ut7.exe2FO0840.exe3CE08DX.exe4Ic616YF.exe5uB4gS1.exe

description	pid	process	target process
PID 2432 wrote to memory of 3040	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	JE9PA13.exe
PID 2432 wrote to memory of 3040	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	JE9PA13.exe
PID 2432 wrote to memory of 3040	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	JE9PA13.exe
PID 3040 wrote to memory of 4048	3040	JE9PA13.exe	IT5cZ21.exe
PID 3040 wrote to memory of 4048	3040	JE9PA13.exe	IT5cZ21.exe
PID 3040 wrote to memory of 4048	3040	JE9PA13.exe	IT5cZ21.exe
PID 4048 wrote to memory of 2708	4048	IT5cZ21.exe	ha4Bj68.exe
PID 4048 wrote to memory of 2708	4048	IT5cZ21.exe	ha4Bj68.exe
PID 4048 wrote to memory of 2708	4048	IT5cZ21.exe	ha4Bj68.exe
PID 2708 wrote to memory of 4044	2708	ha4Bj68.exe	1Px39ut7.exe
PID 2708 wrote to memory of 4044	2708	ha4Bj68.exe	1Px39ut7.exe
PID 2708 wrote to memory of 4044	2708	ha4Bj68.exe	1Px39ut7.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 4044 wrote to memory of 4908	4044	1Px39ut7.exe	AppLaunch.exe
PID 2708 wrote to memory of 4844	2708	ha4Bj68.exe	2FO0840.exe
PID 2708 wrote to memory of 4844	2708	ha4Bj68.exe	2FO0840.exe
PID 2708 wrote to memory of 4844	2708	ha4Bj68.exe	2FO0840.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4844 wrote to memory of 4700	4844	2FO0840.exe	AppLaunch.exe
PID 4048 wrote to memory of 3496	4048	IT5cZ21.exe	3CE08DX.exe
PID 4048 wrote to memory of 3496	4048	IT5cZ21.exe	3CE08DX.exe
PID 4048 wrote to memory of 3496	4048	IT5cZ21.exe	3CE08DX.exe
PID 3496 wrote to memory of 4016	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 4016	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 4016	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 1964	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 1964	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 1964	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3496 wrote to memory of 2576	3496	3CE08DX.exe	AppLaunch.exe
PID 3040 wrote to memory of 1156	3040	JE9PA13.exe	4Ic616YF.exe
PID 3040 wrote to memory of 1156	3040	JE9PA13.exe	4Ic616YF.exe
PID 3040 wrote to memory of 1156	3040	JE9PA13.exe	4Ic616YF.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 1156 wrote to memory of 808	1156	4Ic616YF.exe	AppLaunch.exe
PID 2432 wrote to memory of 4724	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	5uB4gS1.exe
PID 2432 wrote to memory of 4724	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	5uB4gS1.exe
PID 2432 wrote to memory of 4724	2432	f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe	5uB4gS1.exe
PID 4724 wrote to memory of 2456	4724	5uB4gS1.exe	cmd.exe
PID 4724 wrote to memory of 2456	4724	5uB4gS1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe
"C:\Users\Admin\AppData\Local\Temp\f9d38578548860b25034aff69de426e59020162ab64834d5c8899353021c57ca.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JE9PA13.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JE9PA13.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IT5cZ21.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IT5cZ21.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ha4Bj68.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ha4Bj68.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Px39ut7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Px39ut7.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 552
6⤵
- Program crash
PID:3388

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FO0840.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FO0840.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 540
7⤵
- Program crash
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 148
6⤵
- Program crash
PID:656

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3CE08DX.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3CE08DX.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:4016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 584
5⤵
- Program crash
PID:4800

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ic616YF.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ic616YF.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 136
4⤵
- Program crash
PID:1388

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uB4gS1.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uB4gS1.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6EF1.tmp\6EF2.tmp\6EF3.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uB4gS1.exe"
3⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc979d46f8,0x7ffc979d4708,0x7ffc979d4718
5⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,15833746205716741703,3475445765968636685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
5⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,15833746205716741703,3475445765968636685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc979d46f8,0x7ffc979d4708,0x7ffc979d4718
5⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
5⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
5⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
5⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
5⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
5⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
5⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
5⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
5⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
5⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
5⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
5⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6372 /prefetch:8
5⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
5⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,18098704869553972590,2936034414552197154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc979d46f8,0x7ffc979d4708,0x7ffc979d4718
5⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9014330945470326639,4505765673798689392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
5⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9014330945470326639,4505765673798689392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4044 -ip 4044
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4844 -ip 4844
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4700 -ip 4700
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1156 -ip 1156
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
e0fe73290473ff6d3af2d4c34938e980

SHA1
f32be74b4d295f66c3d6d63dc8e1aa16922aa517

SHA256
fe4ccacf50911ad1ea85522f8a298e06dbebf9ae78737fd48f444cfdd59dcc11

SHA512
222c9419d6d7952450e059a43a532608633410a5eee19537445bd71286f17d7066530fb55e5723d4dd90930f9f460730fb7ed7c23bd920f0a456d6f84daeed0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
7eba4f04a99d28bd9c2f9e1060ea0d31

SHA1
c6a6e5010134bf52ab8028569707afb2a65513ed

SHA256
5a9f59a8ba461636e78d33bc1371fb87b6703bd2c1c3f399e2d4124fe55e8fc0

SHA512
7de6297ea91a39cac2dd8ea5878a49048c61a04113dca5150431f9fe99de09ebdcba84dd635dc97138ae5b8ebb159e4878b7b4e603bf5fa6d41802b0fc5984db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
db1f4ef90d659dc90ad35ef52cfa2d5e

SHA1
71b7c1c479c782ab55fd8be184df0f79051f628a

SHA256
ee8a3d1385806ffdf30c64f47bdce5e6680f34521a3dcd8b4a914f7b4302db01

SHA512
2ee0db53dc46c017141ecf86ec5abe94377d50cf2a8f200010db913c2269bc5a9aca6126235426422bbabd07d16683c673eb9400997df06f97361de853166de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fa3afc2aad7a86c6fca1cca65104ece7

SHA1
f6029372cec78894aed371e74b309700099b8b61

SHA256
9a6e3300a117837531868b3a8895547328643d02ff8bb793dad6dad875016bb2

SHA512
37d23e86ac813b234b03a72073551fdb5b5c4316e377067204a30e846c0e80591f5f3f2e2fdb620ce56668d0cb107db6ca3cdf151b1f24334d31bea266fffba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
db35f934031beb853570f52dc81928bd

SHA1
4d2fa8c99b4cf37737134e7ab05e688794e6adee

SHA256
22505ec2836d5552a94ecdb9755f27aeaeba8f0fb13fc7ba06c5b7c1ee05f3e6

SHA512
3c08033d8cb5ed8b18e6d04253ce22da85a2434294034e3a1daec136b16b4ef905c0c56fb8c7bbea808a224161c13ca885ad18e381f96918d83b0554ab3ef85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
41ddbe4f3e5669cf31d6caf1abae9feb

SHA1
d720ee33a288d0ea83b3b1ef367c0549668bfcc8

SHA256
a30e583d24554788ca233254729c3dbaccbffe727bdebd89cefdd95117c2ff7e

SHA512
5718a1a2539c815230b25ef1c4fbb9254342c6d7c7a63e1aef94bb549990800d7b7f90a080990416eef5f22b847f9545f89b37db5f82d47db3c9d20c38d959e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
e9d470cb46e97ccb0abd44b54f8915c1

SHA1
4866cbb329d473817b2308e3f2eba852c103628e

SHA256
4c59b22e7dba9c0c7729f8a3c3a8af9011da15f8e9b1d83d4ebf9331d577fce2

SHA512
a090c78a4f2b7c0b4630d4c09a7b9d02bfb49a6e8bb496c8046323c28b78271d6ae3eb6fb3cab47f4db52ca728174fa28507be43ca6c831472c5b58f1a0abf5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
e6de8fbf7993e033deb3e80696aa4f90

SHA1
1fc576789acbf58a816dbe5e34c80e0d3ea6b30e

SHA256
5961c59cf370c3a15d71b7c1f99057f83246f03c461b629a32752f8e0c47825e

SHA512
30aebecee327f2daabc7fb0fa36c7a08ec976503e2e3d0d491f796800e21b06bbd1a51e6c227ea021cb5ada7e3bb0dda0bcd994a02ba8eb034f062a796e17d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
f648c5565d5e7e08f46e96669d08fff1

SHA1
cf11f0d44e166a84c0778ab83556f014b33b6bfa

SHA256
9197e4c1ab3ef718850395b6679850022be874e0a184b8838aebaf3713974d70

SHA512
527f26fc386ea798bf474b99370fc9c962f69524f9e31b98dc50251daaa1a1d4a781c4254df6c671f537bbf3a404c78875da8e8ac201256499ffc33cd80463d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b57b.TMP
Filesize
72B

MD5
600ab716c31a95bfdb660adf35a3fa98

SHA1
b2e5112b3cd5b274ff62d19d9fd80389dc0450cf

SHA256
d7ee391de896cd4dc6fdd92762a389845aeee711ed71fa42ca62952cab1ac528

SHA512
6f6e8bca34a59a69ef3010cef81d93040e92ffa924ac8fa2010528778921c577587742948da02bf2afced697389cfbce4262e22f8c0c9ab78a002634c84bb98a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
ea5cc14aefb5bd75a559321c3d5eb2dd

SHA1
a83573d7f753479e87110b79da661983ee0a598a

SHA256
4a2c4432c60332718fd9cadf05ef8b15a02c3b26d3bb76c45ea91c8cc703424c

SHA512
333d0de40f298e7ebe1c62834bae8ae583759bbfc2f3f6d33c7e2d7435a328a54fa98b9aa469d9dcd1cd6eeab9460986b197b695e8e4a6033fd85f2c39df2397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
b9fac174ffe54669ffe074e46019efa2

SHA1
b7e9858ee5379447b5061c582776ff8fc21926c0

SHA256
e7b9807240a354d9e3cbe6440500e0162365fb53ce5863c7399ee3f17c18dbb6

SHA512
3799165adabb766045266053998731d96e287a64701b66d4cbdc78c5ab3cc4d2d2ee3a8277980d0dc4bb7b7d860760f5ece5eaf01b0e18a8f08006b49bf6e68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
9f4ada65f4b891b90cad7f2690e3f16b

SHA1
c2d236c79ef9733339f73cccf6f9d6525dcf5731

SHA256
d7b1429cc8bf920b05f1a013292b680f96621de20fb88f44002160ed1c471ee6

SHA512
88fe3e2c0b9f4fc5ec8200c6e68c7c513b5fa227f101a3eb14a0386a168ecf08d42a5102391c499c652b5acdf15fd00896083e2e5385841a0a2a6e6d86e66661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
57591157fbf84b8b1c623e17a7ab9aa6

SHA1
909da42fa67753ad6d6a372430aefc873fc140c0

SHA256
8a86a910c7d0b8f255606a9a3cec7a8da6269e98d261ab7a96eb49e6a1dfbaa6

SHA512
924a8eca84214edcfc2f4c4125ebc6132141372777c61d827742f5cc542c0392163016692d59ecd8cff4ad99cc7954d5c21e20eac9e8c7b7c19260e955640e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eccc.TMP
Filesize
872B

MD5
f1f6ba5764b315b4951b52593281515d

SHA1
6bf3f868b4c050b4b74ab0936625d62285f860e4

SHA256
62e2c84bda731839e5bc30d124250aac3bafa9a8372e5727eec5f693f29ae1fc

SHA512
034eaf9eed0794bd8a8173f312c453cdbf3a0b53797668e103d3bcb9fc5c535320a9d04c5b60db77f3fa8627839ad3562e0683a3bae268835bf45c3cf4b97ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0fad0700bf217f15767d6524ab1b224a

SHA1
f65cb0310fc308d5136de47b9be0f79c02ee3ddc

SHA256
5383c44066f2fe7c108f18be064941f0775bcc18580c66c0927085c84e1e5b9a

SHA512
d516ab1e883750ca63de8b89cc79462e5ea386c96c7ff60bde7e2ad5e8d2aa61f6609d98b5a134b58d56cfd5c74e171c45198316b921ecb78eaf4e168ff61a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
978f19199da08f19464b50391e507927

SHA1
f4d4a5cb30abcc29df1fddaffdf449b55cf93c89

SHA256
ee401b4b28065409fe6b0a263063cab928365fb3bfb9c33a5e709ad735230c5c

SHA512
4b450c68ba6a7ee635fb2137efa4292d697f9cb82ce55ebd1560f5374fe8a9e4ec3c026dacce9b701033d54ecb990eb36eecd1326c2b7baba927cdf7de4f9de0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
d618a1d8f4cea4a32b350026dc683a86

SHA1
7836eeaa9cbc5e39e1a2bfdb6196a11a28686b9e

SHA256
e89dc507a238853f4258444f62bb91cc70684333014ef4d68e5cc4eeca0488e5

SHA512
c5bd1ac8ac375c6c4dfa9598e3289c48c33dbcfe073477604b83845b2762e9ca3c8a256325f036a1922a96ae54616b024d84f806c9b6847999239eee8e71d3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
03874f857bcbe30ae366f530fbc3b0a6

SHA1
7ff9026dee30bebd6dc479e4c1a618f24ae93a0b

SHA256
b6bb70bb7e36d7ffc527c527742e895a9bbb2a2e8c97a12cbc301bca46105fbe

SHA512
c3fb581581c3ffc16ca6035443043047e322354e8f0ad91face88396055c20e741ad2c37f9a9deedd09b6d73313d68db6fd3aed298b2d99f3656184afa8efc99

Download Submit
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp\6EF2.tmp\6EF3.bat
Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uB4gS1.exe
Filesize
87KB

MD5
06f8b4b3dfe7a2ed9534f78765e5c623

SHA1
43964ba962303ff5dbe3f3b2d0ccb6088ae7931a

SHA256
0273130e9b225c0c4d1772535a382e27d79bd0de807ad537aa305b129c517bc2

SHA512
2844f324b8c9e86cf312d5e66c580d069f386a255455f087f3ab146cb6db5d5da3aad45962e826345f2ee67b6b8d19cc30da9e58ca310e8eaddc89f4bb7f42f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JE9PA13.exe
Filesize
739KB

MD5
24dc758b8982a91afe8563dc9b6505b9

SHA1
9dc6312ae33de5a8294c76bd32a50354659d1c1c

SHA256
e93482911cdbbb2670d4b4692a8ef5b479b56647308309776d38e8e4640e81bf

SHA512
2e736897e8dd637d25b2eb812fc2a2ae60f31bf778dde1a61d8dee3979a6efe4d8678ca03b3c4a76c9cd863256f1946388dc93dbe46695ecd7c07c003855886e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ic616YF.exe
Filesize
339KB

MD5
b6065a3e30887f2c4bf46c81437f8db8

SHA1
3ee2c9352894427de00093e4686597cfca21abbc

SHA256
c22d72bdc936010e01f24d4e5d429139ad7826846ca4652ebb664e73832e2a4f

SHA512
52397a06d938cc2f21584b32414049faeb717d658ed8dd4ff6c07b8ee8bb9a084cbf0887a0eccfbe1a05d37d65214faf43c96a0da063ae5ba53f9caf93f27a6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\IT5cZ21.exe
Filesize
503KB

MD5
68c126c0483a85333bc96d631c116142

SHA1
9992f54d0126ebfdb5f5cb90d91d2b48351eed6b

SHA256
74f32a5232a45f65d671660dc3177c701c85de2500113b7195a96a4d97af2df0

SHA512
b9942372b9b32191dbee459d6399d7cb91451df33691f99078706832d29d0fc1f3755f39b38ac54c0156e50a264d9120e20aec7f1ad30bfcaeae10a187d76f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3CE08DX.exe
Filesize
148KB

MD5
aa52fdd2418c834d99276c985fdbaf1a

SHA1
c56dc824babf8d0d53e809d5d0db680a37a02f63

SHA256
50ba13ac3e6f1ea5a91a0c62d1829fe9bdcb03d098018ad094088f67b7a80f38

SHA512
69418c5d5d0e3c0099e4eb026211a674a6ea14af0d6b9821456bf0df6948ea9ce61bcdcf95d84077875c795535fa58169d397d8b7f46a09c8ef9d57829680c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ha4Bj68.exe
Filesize
317KB

MD5
1e71d0be349396195913d65c7a46339a

SHA1
d6237a9c9ff2bdf96bea08707fa5605f3f88c501

SHA256
90df95b4584663dd13009aeacca9648600a0bb6daea1bc78ce397020b6753b57

SHA512
e24511b4e83d1f4eeb571343ef5a55bfb9e809eb2a0d2684c7156101324a296bc7635a42520452fafdc27e65845fd02da3bb095fa67b8ec71bb1f8b5e7393a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Px39ut7.exe
Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2FO0840.exe
Filesize
298KB

MD5
39a77dd444d335e91b247aa7cd8a3ca1

SHA1
8b97ae2fe569679ac5f641c46eb2d3c8e8b37971

SHA256
2b800882ff65ee4010d5fcbbd38330c4ce0c817afd53060523311cd87e7c082d

SHA512
f407040ae1dc453a96ef10d06d694208ea0bb6374e4ac243be85da42abdd0f085a8f88d623c3104c4dcc09b5b220a0235bbe46035ebe08dfa599cd58017da119

Download Submit
\??\pipe\LOCAL\crashpad_2240_BYGWPOWYPZAUQEOB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/808-63-0x00000000077D0000-0x00000000077E2000-memory.dmp

Filesize
72KB

Download
memory/808-51-0x0000000007BB0000-0x0000000008154000-memory.dmp

Filesize
5.6MB

Download
memory/808-64-0x0000000007940000-0x000000000797C000-memory.dmp

Filesize
240KB

Download
memory/808-62-0x0000000007A10000-0x0000000007B1A000-memory.dmp

Filesize
1.0MB

Download
memory/808-60-0x0000000008780000-0x0000000008D98000-memory.dmp

Filesize
6.1MB

Download
memory/808-246-0x0000000073A60000-0x0000000074210000-memory.dmp

Filesize
7.7MB

Download
memory/808-59-0x0000000007650000-0x000000000765A000-memory.dmp

Filesize
40KB

Download
memory/808-57-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/808-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/808-52-0x00000000076A0000-0x0000000007732000-memory.dmp

Filesize
584KB

Download
memory/808-286-0x0000000007670000-0x0000000007680000-memory.dmp

Filesize
64KB

Download
memory/808-65-0x0000000007980000-0x00000000079CC000-memory.dmp

Filesize
304KB

Download
memory/808-50-0x0000000073A60000-0x0000000074210000-memory.dmp

Filesize
7.7MB

Download
memory/2576-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2576-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2576-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4700-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4700-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4700-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4700-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4908-34-0x0000000073A70000-0x0000000074220000-memory.dmp

Filesize
7.7MB

Download
memory/4908-29-0x0000000073A70000-0x0000000074220000-memory.dmp

Filesize
7.7MB

Download
memory/4908-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download