mystic | 08bc11d00eb56ac42fa5376b47d28c1dfc8fca1c9274b0f411e4fa6f10936793

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
Size

876KB
MD5

7e9fae8d7cc1200ab396adb65ccc63eb
SHA1

40acce023862cd7dd0b1371a53adcd7a88c7727a
SHA256

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38
SHA512

e1e8c3d4e3dab98ea34604b779fc1706b597034f60b198480956c59a54a08ee29c11fd4afb17c1e4ee7e760b3e77ac4587998c9d3e9e9cca6f3ea150afc55ebe
SSDEEP

24576:rysd2dsAJiOiIP7UXQWuM/72YHvyhovHR4JI:esd2KrOiISQUNo

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2356-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2356-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2356-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1528-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5io1fP6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	5io1fP6.exe

Executes dropped EXE 8 IoCs

Processes:

IF8nR03.exerW1MH58.exexp3Za77.exe1So65hY3.exe2Pf8143.exe3tA26Tn.exe4DN776rK.exe5io1fP6.exe

pid process

2420 IF8nR03.exe
4524 rW1MH58.exe
2836 xp3Za77.exe
1084 1So65hY3.exe
1928 2Pf8143.exe
1556 3tA26Tn.exe
1752 4DN776rK.exe
3712 5io1fP6.exe

pid	process
2420	IF8nR03.exe
4524	rW1MH58.exe
2836	xp3Za77.exe
1084	1So65hY3.exe
1928	2Pf8143.exe
1556	3tA26Tn.exe
1752	4DN776rK.exe
3712	5io1fP6.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exeIF8nR03.exerW1MH58.exexp3Za77.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	IF8nR03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	rW1MH58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xp3Za77.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1So65hY3.exe2Pf8143.exe3tA26Tn.exe4DN776rK.exe

description	pid	process	target process
PID 1084 set thread context of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1928 set thread context of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1556 set thread context of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1752 set thread context of 1528	1752	4DN776rK.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5080	1084	WerFault.exe	1So65hY3.exe
4980	1928	WerFault.exe	2Pf8143.exe
2004	2356	WerFault.exe	AppLaunch.exe
1600	1556	WerFault.exe	3tA26Tn.exe
2108	1752	WerFault.exe	4DN776rK.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

AppLaunch.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4984	AppLaunch.exe
4984	AppLaunch.exe
944	msedge.exe
944	msedge.exe
1920	msedge.exe
1920	msedge.exe
3264	msedge.exe
3264	msedge.exe
4932	msedge.exe
4932	msedge.exe
5184	identity_helper.exe
5184	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
3264 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4984 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4984	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exeIF8nR03.exerW1MH58.exexp3Za77.exe1So65hY3.exe2Pf8143.exe3tA26Tn.exe4DN776rK.exe5io1fP6.execmd.exemsedge.exe

description	pid	process	target process
PID 3552 wrote to memory of 2420	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	IF8nR03.exe
PID 3552 wrote to memory of 2420	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	IF8nR03.exe
PID 3552 wrote to memory of 2420	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	IF8nR03.exe
PID 2420 wrote to memory of 4524	2420	IF8nR03.exe	rW1MH58.exe
PID 2420 wrote to memory of 4524	2420	IF8nR03.exe	rW1MH58.exe
PID 2420 wrote to memory of 4524	2420	IF8nR03.exe	rW1MH58.exe
PID 4524 wrote to memory of 2836	4524	rW1MH58.exe	xp3Za77.exe
PID 4524 wrote to memory of 2836	4524	rW1MH58.exe	xp3Za77.exe
PID 4524 wrote to memory of 2836	4524	rW1MH58.exe	xp3Za77.exe
PID 2836 wrote to memory of 1084	2836	xp3Za77.exe	1So65hY3.exe
PID 2836 wrote to memory of 1084	2836	xp3Za77.exe	1So65hY3.exe
PID 2836 wrote to memory of 1084	2836	xp3Za77.exe	1So65hY3.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 1084 wrote to memory of 4984	1084	1So65hY3.exe	AppLaunch.exe
PID 2836 wrote to memory of 1928	2836	xp3Za77.exe	2Pf8143.exe
PID 2836 wrote to memory of 1928	2836	xp3Za77.exe	2Pf8143.exe
PID 2836 wrote to memory of 1928	2836	xp3Za77.exe	2Pf8143.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 1928 wrote to memory of 2356	1928	2Pf8143.exe	AppLaunch.exe
PID 4524 wrote to memory of 1556	4524	rW1MH58.exe	3tA26Tn.exe
PID 4524 wrote to memory of 1556	4524	rW1MH58.exe	3tA26Tn.exe
PID 4524 wrote to memory of 1556	4524	rW1MH58.exe	3tA26Tn.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 1556 wrote to memory of 4740	1556	3tA26Tn.exe	AppLaunch.exe
PID 2420 wrote to memory of 1752	2420	IF8nR03.exe	4DN776rK.exe
PID 2420 wrote to memory of 1752	2420	IF8nR03.exe	4DN776rK.exe
PID 2420 wrote to memory of 1752	2420	IF8nR03.exe	4DN776rK.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 1752 wrote to memory of 1528	1752	4DN776rK.exe	AppLaunch.exe
PID 3552 wrote to memory of 3712	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	5io1fP6.exe
PID 3552 wrote to memory of 3712	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	5io1fP6.exe
PID 3552 wrote to memory of 3712	3552	7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe	5io1fP6.exe
PID 3712 wrote to memory of 3764	3712	5io1fP6.exe	cmd.exe
PID 3712 wrote to memory of 3764	3712	5io1fP6.exe	cmd.exe
PID 3764 wrote to memory of 208	3764	cmd.exe	msedge.exe
PID 3764 wrote to memory of 208	3764	cmd.exe	msedge.exe
PID 208 wrote to memory of 4340	208	msedge.exe	msedge.exe
PID 208 wrote to memory of 4340	208	msedge.exe	msedge.exe
PID 3764 wrote to memory of 3264	3764	cmd.exe	msedge.exe
PID 3764 wrote to memory of 3264	3764	cmd.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe
"C:\Users\Admin\AppData\Local\Temp\7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 556
6⤵
- Program crash
PID:5080

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 540
7⤵
- Program crash
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 572
6⤵
- Program crash
PID:4980

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 152
5⤵
- Program crash
PID:1600

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 224
4⤵
- Program crash
PID:2108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9CFB.tmp\9CFC.tmp\9CFD.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff4b3f46f8,0x7fff4b3f4708,0x7fff4b3f4718
5⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9335196027127860130,8863121561316161153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
5⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9335196027127860130,8863121561316161153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x140,0x16c,0x7fff4b3f46f8,0x7fff4b3f4708,0x7fff4b3f4718
5⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
5⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
5⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
5⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
5⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
5⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
5⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
5⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5680 /prefetch:8
5⤵
PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
5⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
5⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
5⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
5⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
5⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7486143901925709502,8640560318296364408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2424 /prefetch:2
5⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff4b3f46f8,0x7fff4b3f4708,0x7fff4b3f4718
5⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2761538343041275736,18335322989279695038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1084 -ip 1084
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1928 -ip 1928
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2356 -ip 2356
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1556 -ip 1556
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1752 -ip 1752
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
494c06f78d1d8bd6fb740b61e51da2a1

SHA1
02d5e0aba2b246bc0b0ece2194926764b0d1094a

SHA256
7820292e0b941b8d5f8eacd4ee2b5b86872ed0edee30ac3400fe093499b51f8c

SHA512
4a4f924f23eed819f5eb11b258311d0a17378bda12c09d0045b688fbac163e2d2ef22726915b71d8c6844773aaac3d949e9d158c5097f595ffa65f5aace7dcea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
86e9e00d29fb0ad9caa02147288a6263

SHA1
228779705aa485e1883833c6b74164d300b0a967

SHA256
506e8bdaff918e68ed4f9c5478badc3b78c072d94d2e7df9e6d4173a390be28f

SHA512
cc527277e21b2c3a449ee3460057e3836787b011655c83d54c335f66818e8f9a15bbac701e62459ece1b0b61cc8f675cc59baceda0c9ff6e14cd14d3da277449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b125151eca5047f1a0a1a0393f61463

SHA1
721968b291ca21b34af325c17eb7b177d2b41a4b

SHA256
e1538487d3559d530f63e8d91c7c92970dad08478c8b0f4a83d72eeeb943fd4f

SHA512
efcc41156abcba729ab7b1e1a7ed78563aaf7ef6bb54ae1f90d9cae8ab72a60dcad71ca0b4305b4bf1bd73bc21954125914b704fa31d56ae471988d085240dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6dcc9e00548a677fc03ccfb6488a243

SHA1
e3c4022bef0f3baaf36dccf0fcf907b288274f2a

SHA256
9dd4b45d569a964757525ad57fee111f490856369e7dbc72366d172e39c04223

SHA512
7d071b56345591f26cf49eb9c56e16c0d0e7096417edea9fc4e2c74ac08d1a02e94f2d8e8dcb77da152c2b3dcdf5b9c5029b198c4d6da43b2ef08d32865370ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14536a035881345840b3d5e91a1a9836

SHA1
07d46e42b602299b2aa1757b411899ffe6b8bc1c

SHA256
57d7b0aac836cec2fbff1ac1078161ec26ab292e48cb0f923500b00beb3ac284

SHA512
9ec6596b144c7faab2fc75c4f9c3ff9ae0e55b6a1c3f8c969b8761687da03843ff41a9a9c3b31d3d19f9d822ec165c15fd9fea3c4cf18ef15067a389fc3885a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
882b882caa507ae1305f1d8564832f56

SHA1
c5f986ad549d9b2ebad006438b762dc1ab21388d

SHA256
b8133bcd85c1b2ded0de1dfc7edf12911c2546791050e7ff015463e570b9740f

SHA512
b8c89b5f2e203041dc967182cdefa0025ffefc48dffb0ab229ed6fd2caa03ff10e02065f0b8655c5054809700d9635bab7b5dd4a56667fdf5da5c8d241e0f185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
c3c705f355f8b729a4f7da7ee24a3e35

SHA1
1ee9e02d7e24aa9534eed5426a8ace7a7156ffbb

SHA256
121f159750cc07b6fd93d07983122758f1e32aabb60f029d12c4f0cd443d4f6f

SHA512
2d4bd45c0a3fc32fb5a8ce958f5ab7615c118811ea921ddd3359a7c8808b61aec5e3c82c408eac02ce2f745eeb4c502b650e052bee7157958d29e1f6b90bd9d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
04df5a45a39920805318fd063b70bd2a

SHA1
12196d228342fe6c9c7612608492a421e46e6e95

SHA256
3d71d62e340d0e4adf1ec544f0dc7514ac615732df1a4ce178497115e4aec01e

SHA512
2d24da6135c7935595997edcf4a4aa663f9544f31bae0ee65d14617fad848bf3d09d8287e54283bd23e32ac100101f4b05beaafa9573058263709ea1995e43d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
35d34fe39d29d8c110a277fada513779

SHA1
9c3a8828d87e9739b35217919818a03057aba916

SHA256
c1f29f78f694b8154582f93dec0ce24ce7505e45ea304b2d61ff38631ec70561

SHA512
3043621a01c655f53eb8f0b1200cd33eb47d1ad8ba2b0c4f3042304267278c69662bc95af40afc2ee2a794ce1f34cb7c4d7421d9e35534882bc1b15c43d1f802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580f8b.TMP

Filesize
48B

MD5
3d85b9befd083da20301b9a590ba9f90

SHA1
0572dd53955c72ed7583fc12f8d4cfe7cfc01613

SHA256
a4a2c6c482cc5c3ba80ea109a9a9765210412fe1751b5a36aecb959afa946980

SHA512
7805948c6c7e07d2d3c2e4854dfc33902783a886f28294be771b5050a6ee414d7375c2c0b7b5db7c0103fa384f5d0c3d8e9feca1dda74325580c6181687d1c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3173db0c3b6edf4be678fa492ddc479c

SHA1
652e98f1ac52644128b008237fc964bb83852a94

SHA256
c3c05230a558167c0d95b4a720db8f85ef0de92402b919943ddd5f98b2120252

SHA512
0132843510ecf1e756b9f020b2718d5998a0ace747835ed9517846415d16d25be2c5a8ddf97e6f0a9bc6ab8c30b8a81715ef9a8c18b8f9849760ed685084501a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0edb5a35050aefd45b4cb1718e0f767f

SHA1
f868195522efd07bbf4d2e492402c405b3f26e43

SHA256
70eab122e2472696ee579298f6e0095f0ff70ba73b8270d7dc32cb60792314b2

SHA512
cd9fd4ce6610f2f1f01fa4a5ba716fffaf79556bb1bf598955ad9c091c385bbda56b28c1544584385eee62eaf3674ec583386c56b5dbcae7bf3586f865d56043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
824459536ec856f284aa8867f7fee448

SHA1
523823c8965e58bd624b24ac7dd8dbd87a6f151d

SHA256
c905f6acf80a27b0b8cb6cc5378a7b20353fd8eddc0d672ad1793245006d8121

SHA512
8e9b4899a692b386dc8c0d1d28973dfa42302fa35cd0e80a37e3251048dd23b999bed61ffcc66a8159b46ee8890c1a4996df402beb5848ae47192adeb7a31acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f414.TMP

Filesize
1KB

MD5
6f7bc9ec1d5b84b449fbd1fca432c992

SHA1
664b6559ae5f428f21cc79a38d8c31336f2cef26

SHA256
5b02d7e37264131b47357cd360f6e2264b43799d0bbc3dae7e3980931a8d933c

SHA512
e7e85eb48a98af242f71102b411a630727d5cd51245276386582b1969461ce1aa5c30dd0d7b1ab389f7aaf9e106aa4f3f4ded33590cf0dd407491fccaada320c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9c18ffd9a9bcbe00dc741ebaa778b01f

SHA1
268e609c1c191e9581f619c0ffaed911fa4d32c0

SHA256
0a29412df877a1df0bf3773b0392de40f96beb1a12f417593e5b530f14c955b5

SHA512
bf69d3ed5d2c77763950ed851de4fa17e522ea133c67488844645ca47e32adc21533dad28ad151c3d9bc137d4e220a5b95d5218fa35f0a9914b3af80e9e5d6e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1317a227e426f1d19bf45c86b7d74c9

SHA1
e5ed446426985a7fe07454762d86774279543f61

SHA256
02efc75d6315202b52bc31eb903bf943feab53dc6d34f08ebde93751ca5ba86e

SHA512
13f9396b1c480b766b0d3a42ac71a0bcd84fec4236e65c1b35db0f14259cc3a81cb7ae47d777d28039bc848f25276b24ee8f9d3b8de04fca91e0e88b995bd1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad31460c-47c7-48ce-ab7b-3b02541a0918.tmp

Filesize
8KB

MD5
8b406210cc1409928b3799356825e4b9

SHA1
eb5a463f1f6e7a42cc30c199a49e698e3dac377d

SHA256
1f511b3f7152cb63dc487150da5711dfe7e16275a4de2a8c48f13dce95bc0ee6

SHA512
d95fda13dbc3010a61aef4a81ece5bf23660c0950af1e4b731e35311b83f58bb816f7d6fe41d5d445391489e552d90a697ea89665d3fc03e62e95d47887a968e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp\9CFC.tmp\9CFD.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5io1fP6.exe

Filesize
87KB

MD5
06d1908205c135c7fe93df36f5dbba84

SHA1
78a66efe772f4f5692f45fd26247eaf77791a77e

SHA256
0bf7a759e5ecc802a9a16031fb4849703ddda47e6a9d794fe005e3614f7ee1d6

SHA512
d4ca7f9e2ab52e720404bc6d09afba396572cd8661888d2306af7cf9ffd302cd2ae6c591f967a67b73601f42f47d60a29561d107b1ce06c540025f703af2afec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IF8nR03.exe

Filesize
738KB

MD5
a71a785a3686cd9ff9465cdeceff1611

SHA1
2e624e0b19fbcd8f120df26acb19360736334198

SHA256
13a5f773d65c07b7f5ee20421d08c928be9a58138676906022dfb879734631f5

SHA512
04d46fbb03098d9818d824ba8e95f97336ce19efd83eda812af56a12f7527e95bc1914425338ff143b43cc961987b768f1a624cd9c0f241c7ba957d77d5196b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4DN776rK.exe

Filesize
339KB

MD5
ff3979268d2c0ea521da7961f76334af

SHA1
5d43705a235f70a7a2fdda1b26a52cbfbac92982

SHA256
13cb70b2a2c54e9c478767103c94eca9ab655c4d95ae96c2d15687f938f1054a

SHA512
869c7818524bcb90c457fe2293f2ca10dd3792d7b25a00987d80e18bf217e16f4ff603285b0ee64faea5f5753651f4b3363debf6208e2c5901af3bc38919e838

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rW1MH58.exe

Filesize
502KB

MD5
7162429f5e1580fbe2f41b267f316e5d

SHA1
4c65898480d15f2052d8459e9d09918b517c3d28

SHA256
da71bd468a4c89ba4f1ba99dadc5648ad415cbc7ade3f87a4bde05f0c77d200b

SHA512
2ca05fa578dd1bd03aa60f98d1614b2755feeca8e9f76de8fb5c62be779b42baeb38b9d35b4d656bd61309ef50008bddc869763d1c79a7f72992cf227e6eb31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tA26Tn.exe

Filesize
148KB

MD5
79d7a9efeb59749776c3fd31bb0769e2

SHA1
b68539d91d51cba2e842070c35dd6b25cc75e291

SHA256
e354c75047b440a71be2d1d1a3ec07507d9991e8b1e8352f90299a35dfb68541

SHA512
76a732683ce9ba34c0bd7a4f6b51da3209bb55c1ba08d3e6fed9e63b53485514bc792a67eab66b2521f6ddc8ffbfdeaecfc25b1b9bbbac2b6d56c48e10d02377

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xp3Za77.exe

Filesize
317KB

MD5
f7cbe5ba92cce2bbf14962bea959bab3

SHA1
40f866268cb16d401214469c94732b8e9a68e38b

SHA256
8ac5c0c5aafa012024120ebacb01cdf334a2143bb2c037f6d7bf2a79a3527292

SHA512
d3a2eb290d31b212644addb540d8b13af33f7cc29b21a42fad2715d84b247f2806aeaeb792504154a87ca2bba1b381c5493fa120efc67b69371b8a4341aee09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1So65hY3.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Pf8143.exe

Filesize
298KB

MD5
e4c4819cfac962973a06d2504b8eeab7

SHA1
9dd189df8641d92036ef97822cb2a6d661f31721

SHA256
0597b863a6bccebf40642317b422f4ace6e7b9a9c312c4f77c94ccef90c5e18c

SHA512
62b106e0086390d685435d3bf768163305f9d780216d586453c7255f5766cec2559a66699e69d54756c1a7c52782b052f9496e85d99ac44e48f4f26bae07b39b

Download Submit
\??\pipe\LOCAL\crashpad_3264_OWYQPJMMDXDSPPFR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1528-61-0x0000000007420000-0x0000000007432000-memory.dmp

Filesize
72KB

Download
memory/1528-343-0x0000000074140000-0x00000000748F0000-memory.dmp

Filesize
7.7MB

Download
memory/1528-62-0x0000000007590000-0x00000000075CC000-memory.dmp

Filesize
240KB

Download
memory/1528-59-0x0000000007CD0000-0x0000000007DDA000-memory.dmp

Filesize
1.0MB

Download
memory/1528-55-0x00000000082F0000-0x0000000008908000-memory.dmp

Filesize
6.1MB

Download
memory/1528-53-0x0000000007450000-0x0000000007460000-memory.dmp

Filesize
64KB

Download
memory/1528-54-0x0000000007330000-0x000000000733A000-memory.dmp

Filesize
40KB

Download
memory/1528-52-0x0000000007270000-0x0000000007302000-memory.dmp

Filesize
584KB

Download
memory/1528-51-0x0000000007720000-0x0000000007CC4000-memory.dmp

Filesize
5.6MB

Download
memory/1528-50-0x0000000074140000-0x00000000748F0000-memory.dmp

Filesize
7.7MB

Download
memory/1528-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1528-63-0x00000000075D0000-0x000000000761C000-memory.dmp

Filesize
304KB

Download
memory/1528-362-0x0000000007450000-0x0000000007460000-memory.dmp

Filesize
64KB

Download
memory/2356-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2356-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2356-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2356-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4740-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4740-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4984-34-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/4984-29-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/4984-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download