mystic | 4f664c42adf81ba9b3ad736a26f7a72c45d641a4164aabc6062e33f3ba2e62e2

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
Size

878KB
MD5

042e9ff3eb2884903c304965a6c3fd2e
SHA1

d488b60fb1d1f0ada321fbe25554b3d79d95327c
SHA256

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93
SHA512

e804377f2e5495ec1a4be6d257ebaa67ec269fc13c6436824b36c8ab31e236633c86b699ae8574d96b715d6ee7bd8bafb319387ce527b3546f857351886d4153
SSDEEP

24576:byWSFeOSZ0QV/2J4UcTjJjAysYTz5dvqZym2FVKKJ1Ka+:OWCC0QVOaj/Jj1VX5dw2TfB

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/464-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/464-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/464-37-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/464-39-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3348-48-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5cH9uM6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	5cH9uM6.exe

Executes dropped EXE 8 IoCs

Processes:

ud0hz17.exenK8Wq41.exeIN3ZU44.exe1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.exe5cH9uM6.exe

pid process

3664 ud0hz17.exe
5072 nK8Wq41.exe
2140 IN3ZU44.exe
2936 1st84YK1.exe
1352 2IZ2656.exe
404 3Io85bi.exe
4000 4iZ500Wr.exe
1592 5cH9uM6.exe

pid	process
3664	ud0hz17.exe
5072	nK8Wq41.exe
2140	IN3ZU44.exe
2936	1st84YK1.exe
1352	2IZ2656.exe
404	3Io85bi.exe
4000	4iZ500Wr.exe
1592	5cH9uM6.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exeud0hz17.exenK8Wq41.exeIN3ZU44.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ud0hz17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nK8Wq41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	IN3ZU44.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.exe

description	pid	process	target process
PID 2936 set thread context of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 1352 set thread context of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 404 set thread context of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 4000 set thread context of 3348	4000	4iZ500Wr.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2740	2936	WerFault.exe	1st84YK1.exe
4444	1352	WerFault.exe	2IZ2656.exe
5012	464	WerFault.exe	AppLaunch.exe
4008	404	WerFault.exe	3Io85bi.exe
2224	4000	WerFault.exe	4iZ500Wr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

AppLaunch.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4872	AppLaunch.exe
4872	AppLaunch.exe
776	msedge.exe
776	msedge.exe
2496	msedge.exe
2496	msedge.exe
3096	msedge.exe
3096	msedge.exe
2140	msedge.exe
2140	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 4872 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4872	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exeud0hz17.exenK8Wq41.exeIN3ZU44.exe1st84YK1.exe2IZ2656.exe3Io85bi.exe4iZ500Wr.execmd.exemsedge.exe

description	pid	process	target process
PID 4036 wrote to memory of 3664	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 4036 wrote to memory of 3664	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 4036 wrote to memory of 3664	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	ud0hz17.exe
PID 3664 wrote to memory of 5072	3664	ud0hz17.exe	nK8Wq41.exe
PID 3664 wrote to memory of 5072	3664	ud0hz17.exe	nK8Wq41.exe
PID 3664 wrote to memory of 5072	3664	ud0hz17.exe	nK8Wq41.exe
PID 5072 wrote to memory of 2140	5072	nK8Wq41.exe	IN3ZU44.exe
PID 5072 wrote to memory of 2140	5072	nK8Wq41.exe	IN3ZU44.exe
PID 5072 wrote to memory of 2140	5072	nK8Wq41.exe	IN3ZU44.exe
PID 2140 wrote to memory of 2936	2140	IN3ZU44.exe	1st84YK1.exe
PID 2140 wrote to memory of 2936	2140	IN3ZU44.exe	1st84YK1.exe
PID 2140 wrote to memory of 2936	2140	IN3ZU44.exe	1st84YK1.exe
PID 2936 wrote to memory of 2904	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 2904	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 2904	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2936 wrote to memory of 4872	2936	1st84YK1.exe	AppLaunch.exe
PID 2140 wrote to memory of 1352	2140	IN3ZU44.exe	2IZ2656.exe
PID 2140 wrote to memory of 1352	2140	IN3ZU44.exe	2IZ2656.exe
PID 2140 wrote to memory of 1352	2140	IN3ZU44.exe	2IZ2656.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 1352 wrote to memory of 464	1352	2IZ2656.exe	AppLaunch.exe
PID 5072 wrote to memory of 404	5072	nK8Wq41.exe	3Io85bi.exe
PID 5072 wrote to memory of 404	5072	nK8Wq41.exe	3Io85bi.exe
PID 5072 wrote to memory of 404	5072	nK8Wq41.exe	3Io85bi.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 404 wrote to memory of 3228	404	3Io85bi.exe	AppLaunch.exe
PID 3664 wrote to memory of 4000	3664	ud0hz17.exe	4iZ500Wr.exe
PID 3664 wrote to memory of 4000	3664	ud0hz17.exe	4iZ500Wr.exe
PID 3664 wrote to memory of 4000	3664	ud0hz17.exe	4iZ500Wr.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4000 wrote to memory of 3348	4000	4iZ500Wr.exe	AppLaunch.exe
PID 4036 wrote to memory of 1592	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	5cH9uM6.exe
PID 4036 wrote to memory of 1592	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	5cH9uM6.exe
PID 4036 wrote to memory of 1592	4036	d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe	5cH9uM6.exe
PID 1864 wrote to memory of 3488	1864	cmd.exe	msedge.exe
PID 1864 wrote to memory of 3488	1864	cmd.exe	msedge.exe
PID 3488 wrote to memory of 1516	3488	msedge.exe	msedge.exe
PID 3488 wrote to memory of 1516	3488	msedge.exe	msedge.exe
PID 1864 wrote to memory of 3096	1864	cmd.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe
"C:\Users\Admin\AppData\Local\Temp\d33d17445df87212813fd8d4d849c66c90ac946e2d3deb9ade08d92c95d40a93.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4036

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3664

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 572
6⤵
- Program crash
PID:2740

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 192
7⤵
- Program crash
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 156
6⤵
- Program crash
PID:4444

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 148
5⤵
- Program crash
PID:4008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 572
4⤵
- Program crash
PID:2224

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1592

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E53.tmp\E54.tmp\E55.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9cd0b46f8,0x7ff9cd0b4708,0x7ff9cd0b4718
5⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,7587804297766419407,16040564516698848633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
5⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,7587804297766419407,16040564516698848633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9cd0b46f8,0x7ff9cd0b4708,0x7ff9cd0b4718
5⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
5⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
5⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
5⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
5⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
5⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
5⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
5⤵
PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
5⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
5⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6692 /prefetch:8
5⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
5⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
5⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,11922812380012965964,287443135246578951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
5⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x88,0x178,0x7ff9cd0b46f8,0x7ff9cd0b4708,0x7ff9cd0b4718
5⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6692688964749458883,9111062613263621148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
5⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6692688964749458883,9111062613263621148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2936 -ip 2936
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1352 -ip 1352
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 464 -ip 464
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 404 -ip 404
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4000 -ip 4000
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
22bb6af63c7710354ac7070e45ac988c

SHA1
34d29d6b316e39ed8fb8c5efb42c4269040fcf1f

SHA256
1a70d5d3dfc04e6f5cfec1ceb06676039229f895f30007fdb55b043ed48ab4fb

SHA512
42c12820b5237caa5b4d5149901f84db6619a69e85cb869df06e07b3cad1b51e0c2d0545ee0129cbc8e7947fd8c2989def537ad2d58a1d5bf2c2a1bf60041ca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
62677bdc196e22a7b4c8a595efb130cd

SHA1
bd2adf18caf764c8f034c08b6269d9693875f3c8

SHA256
b540616d7e73ff22642f4fbe2bea0f9daa2f1166391e76cf817b2a93e0bd41d6

SHA512
d23c3b9662eea6a75382242fb8e8084abc1127afbd2632f161df71a2aefaf223621511e1bf6229cf7e86313101a8d9dfe2f20e1c0bd481066e1969cd6fa75e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
bff28b777558241107d505b1cb4cab06

SHA1
096e8edd46b59d7f56a7f01f2220d1f21e2cb054

SHA256
7f44f4ba3885de782e7155715c3b847c38463b8f03c9e4427b61777fcdcd751a

SHA512
7eb99f3d77910029c832e423ee9985b70e353e22e78003929a923b9512f1e8037bc31cdbcc38c6a1010c13376cc1177fc54361c4d536cf30043df3db7efb458d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
4f5795af1b01597aee26551327caff2a

SHA1
e3b4a02b9d3c013e1a65476d6e711beabaaeaf75

SHA256
6e244af233c1b83b9825a36de8b391c1eb4e5cd36f30428a304325a6786146eb

SHA512
4be4fa571db71fcda9bf97b941f83eef19045ccca444befb34a25f3dce6b8475e054cdf2421c0aa040f2d7887e82c921373d754e7385dba9f57329cdb5d4bb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
6d468295357cb688aaddaa670e6c65b7

SHA1
095cebca8aa57c297ae8bb09de75c3eb9bddbabe

SHA256
0da0425e802eb0b9b0255ab4e7bb316ed37e1005a03241c96ba981c1d292b3e0

SHA512
0731b1a54b8f6edb195dc499fe065bd24b95afcf829e3c104232f2092439bc109038e4d30d11504881d9f8e824d8686dc4024a0c9a5ad5c5ef0af8f1409de113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
cc25b49775b62bc1c5d01e18f0b8850d

SHA1
0c318f59aef14f6a7ac96bca6b6d38b440cdbe57

SHA256
018b6ad687f6d8066838267e65b46a058504d802ea3c773b3d8e1953193fbc55

SHA512
ebce30083eea80e5ca16bac314133264c8157d8408e23fecb58370166e7d47a7c560ded838b5bfbac7069fe34082460f3f78676a2a769cc34f326c84b0bf9685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
e2b6c25d90afc6a66d75e18931ee445c

SHA1
2aa772a9ebbc68d139df183d65a0d5dc4b236dac

SHA256
14d477b8b805d7d77ea41ef01b3582bce00a88d2ca2ee26ff97344eb97b34fab

SHA512
019bb19f92dbc8421a25bd25b3b7d037639e632e5969e4d97416166859f7cfbc5b4c6bd8ee6e64fcc6480d24bb0045143946e0c38d453a0e0128c27c032d9c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
933f8778ec3af5eb94b291fea3cb45de

SHA1
539954bbb9cc0648f3345da326880f90fb7b8955

SHA256
8b093e9fd2a29aa772af2e4b6b1890f45a0289871642a5fc11ee8b9b4403cf6b

SHA512
d60276c4874781f6d8ba6f14b18e884692a6c966180a66d11f6d91f95526ff8a8a8960f473c88d26eabf13090d1afaeecb611d766c8ceb0c2934c42f71977719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
c25b1b511f6bbef11beaa397ad60a9c0

SHA1
8cd57feb35c93bd0ef70839867e0c789ccdc032a

SHA256
e8fc76e2d402ab10ebf7de34fd7628d7e245ddb9f60710879b2b4025593e896f

SHA512
5d17e2373571397408a5b9be71f4e27260d3f88ef0e2188b294a5d367c450c528ab1c0a47cff1494275444d2c4762e2993f4455837b4aa4d9973284b97c6eb37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
8292ae4e6bc99df38b7486db59ed9bc0

SHA1
2a826d6afefc140139d72973e71f937ff0b479d6

SHA256
604ce27f28f8ec1f9a2d0c9ebc0b084331cea423d6a2cfb686e0920fd4878e4c

SHA512
3e35a834d3a91ac2c7b53238a28b9fc6cf26037011e48367e5289e89f15e51110718df52a0d751ab749471c95ac9a40840d7e9406af5a28ba0658eb0311196c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
ac1cbdc34330f975f413374777f6992b

SHA1
012a6806a3704f1a54b78cef3d799d6a7a6fd307

SHA256
e283630627a70453cbb75d3768a8055a0ad02c56957e8cc24a79690214bea3c5

SHA512
968beeae343b11014ed554a0464311220a83fcbd7f6d37ff76bdef1ad26258f6ec30a07f9edb5536571da2ebe9c3fb98adceac2d0ef3aec669c7a255b1a478e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
0c6e012ecd8576a2c9ce5b79c6074af6

SHA1
14292211cd59fcd50221c3ef3b347677312c404d

SHA256
124d8dc8f5685fd88d929afdc124e7208708dd8049348b9dda55730f397a493b

SHA512
bec2c14ad9e0ed7e644fa1207029ac1ea166709aaea87aa4f7f6c34489a0851007bb825e87e2128009a2d01e753975a0954c1ad4881fc4f046388265d6b80567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589006.TMP
Filesize
48B

MD5
66b900a44ddc7c67f0869ccf7df4718e

SHA1
7864d44a4fb48d07e0d8e2f06e0276816225ce82

SHA256
7fef209da4a7f0d5860bb5ec251bbf260fc8a342fc93f36c732d54aa543dfd48

SHA512
16befd48ae0b90ab463f43080c5ef1ca35a19c737e364b088727e18cc72b200098cc3c35e6cfe73d4d252219b715c60bf4402d3edf4ebb34e25f7f614a477912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
739f0592eb8ac0c34cb313c38e19f686

SHA1
971225833e5c62a355c9a1c0533ab3cad10859f2

SHA256
817b932690e3d4ce45fe727cac8a39dc90dd5c2911390e793fad663dafe0331c

SHA512
8c83b7dbe2631e9d665669431367c97e05125eb9d8845ac5875fd9902e04f46b4b7fdfde626ee5bbf6dd74d1e110d7b49f19aeea92f7b285c6157e6e6f658864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
3395e23c3d2fdcd63218220254dd1681

SHA1
87e4dcb9308d766b3650749c8a391c9b18c94c8d

SHA256
66ad5eec8081c4ed732f0e175a00ec3fabac584466ac8a7acb11d621d4c3c494

SHA512
79db7572d25727746cd08fbc99c78766d19c93eb20d98810ab7fe03d5815cfbe3e9c69909c656c488cfbba5e95e3480d3c32e7a3c4f54b8fe8f866d8dd76083f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
2ecec143306f61082eabcc8f1aa2e01c

SHA1
dca0b9d7459d4f56004c975d72a7f5fcfb38b7ee

SHA256
24821a497f4ed0f4fe9c7772d4b1bea132636b8dbebf44fc86e830347ba034b2

SHA512
50994f5c3f76857fa44b5e2c788066baebb90d4697e5475a620a17af099537db0cee9d65b6bb686d693645871acefc8c4da39b6d812d20cc271b5f720e9b9058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c90.TMP
Filesize
1KB

MD5
9b3c575fd8b33019b8445cff27c8571d

SHA1
c10cd9aeeec658f58b9eb72fd98567bcdb3c6bd3

SHA256
be26b32a54af5cae19daae20888b54f770d7e598f0dcb19c456e52a3bbc78aab

SHA512
0fe277a93c8c7ccaee8f79488cbde53cbe1018efb71fa075d785ccdd9bc3f825541778bacf3448cb0ae15bf3c3f31aab5939947b347824c7e81603999339a370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6675e4d000fcb4d870a5d94e115bc087

SHA1
53590d45b202792e1797f526ef67f1a724637dac

SHA256
6f2bef2d83c0337ad5f88fde6ac501f8782096d163f009b89b90e1890fb07b90

SHA512
bfba2b02812309b44e626a0ea235e4dbfcfee0d7cc5bd2c53d74083b75864b3befe279c666639d97b29077ae0f94580017bf16b428ab0a64642fb261419439c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
461c3b63ecec2aa53d4640676706ff83

SHA1
76ebafcaedf78ad3c85f7ab9c4930b8c4847ac5d

SHA256
d7e099c93cee1bd1a25fd5329bc01f076a98eaab111c725fbc50d8cf261768f2

SHA512
a18486d96ec7ad558c15a8cdd45450ab3b38bc6578d438396f2c4d798e4142a5be93b4102139339f56d1232f27619f415a9828028f5bebddabfe5dee474b0bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
0c77feaba7fd34cddf3ed8d8e5e22943

SHA1
48930f125ebbb4b349e2413b997415e12bb8f09f

SHA256
80061112cd8eb193babdee58b9e1ff223e1194b81d8a8973ab8c58f9f4ccd64a

SHA512
994aed33c191d914c315fc895dd515dcbd94a114b9468ac348bfd92e4e57a26dd61887f6d29f3263040d5963eb7a9e5ce1bfd066c9aea940ec3a2b9b1038dede

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5cH9uM6.exe
Filesize
87KB

MD5
fb67f34d0ada2990f0278f5648f32541

SHA1
57ee472fc5ce8dcd0c6b1565c89a32a09b491ba8

SHA256
4973b0dc69db1989b694dc8a0eff4c56c67bde6b1ff2a6027f6f4f1d1a281bfd

SHA512
31994b7b3dea3c7645914e3d22efcddcdf31dafb6747851c1759be12d2be8c02fbb493b5435980a11da5b6d6c9058c08686bb210e508b133162af4f82f3d10aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ud0hz17.exe
Filesize
739KB

MD5
a673bd803898cc35bc8e5e5bb0de1ceb

SHA1
9d9b0927e0013fd07a36dcc125e0d0c5e3daaf68

SHA256
d05ef131874285781e8795684dbf902e01c5827cbc2c1dbb56a5ed3bc8a7af45

SHA512
19370e94988b9a2ad56b72086c7df2c6220c1572d9983a4755220a4dec5a32e11ea30d0e045a64bf9da94862287de025b10898a9be2ff5790ec8ed0226315915

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4iZ500Wr.exe
Filesize
339KB

MD5
584b2345f19a49499216acc7c40ff35d

SHA1
c5d369114119b01919e05ee42903818482884640

SHA256
d7ea43683b0c02b6017d7a942c9b83f3af24466b139e25889c2c8ce05978c8c4

SHA512
504b9ca061eedcabd189b1f66d9831f0413ee5c934a700a266633876dff965986bc99fa18167e785d30a192fbe9d3e092de097f9e034f7157c76565d1c140059

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nK8Wq41.exe
Filesize
503KB

MD5
a3072f223d8b127f5d60ab7e17b4c16d

SHA1
ddd6ca99b8b24b7ec0b5cdbec67f09ff373b62d7

SHA256
4a00b95401194bbc4d92435711b95cddbc756cc9c6d83a18c9352c383574af2e

SHA512
65455c9988317405b2592d9389edd6dd3ca8e0333aa3563d025b8304165fa1832ce786ba90ee16c3d63fee8167bf2b79aad66102a313dbd3176ce3ac598328a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Io85bi.exe
Filesize
148KB

MD5
b038b0e342643bc3a0bc3ad8055cc565

SHA1
38319ad09fe941b356f7427993e76a13deacf395

SHA256
96ac531d92116544f2f0c6395f0da21a3415842f8f125451c7cab40910658a3d

SHA512
b6ac665ab5d00ad09b738527e97617ddf8ee28e0d70e7839f0cd736f92026e93111c89714a07437bf240be8b20b906b840abacca5f92db9bf74d7f292e4624a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN3ZU44.exe
Filesize
317KB

MD5
2bb5bba4a8eab90ae7dd7cd043be1b33

SHA1
89fa57099ff9f4b74b2057720d95eafa1167a095

SHA256
6e926873fec3965c4f9a185b4b0cf3ac0c7ae82ca65559fbbdedbbaabc69c270

SHA512
59609a664408ffa09696d5ef0dcb913d7623aa111b045bf2862f72a37b873ae879d44b3fca680cbd03e28ab0e0b075e9f8d7bfa97c5f03ddffeaa9e1009b8762

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1st84YK1.exe
Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IZ2656.exe
Filesize
298KB

MD5
528d0a001176d87152bd55ab7f963d95

SHA1
2750a4077744ca041e61d0ce40ae1daf4fd2b5fe

SHA256
8fe1e47cd448e306870845cb9173ef88a4dbeb1dbb6fa28008ca174048710e8e

SHA512
dbe80101ae3b78ebb103c98ac61f1779ab36047917ac8dacff3c8dba73cf9051d80bc3e91592ffb3b9674d989eeb47c68b72ed2421a0936027a7e71a4b91d3ec

Download Submit
\??\pipe\LOCAL\crashpad_3096_BKFXFTKNTUWBOOYH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/464-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/464-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/464-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/464-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3228-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3228-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3348-361-0x00000000079D0000-0x00000000079E0000-memory.dmp

Filesize
64KB

Download
memory/3348-53-0x00000000079D0000-0x00000000079E0000-memory.dmp

Filesize
64KB

Download
memory/3348-58-0x0000000007C50000-0x0000000007D5A000-memory.dmp

Filesize
1.0MB

Download
memory/3348-57-0x0000000008980000-0x0000000008F98000-memory.dmp

Filesize
6.1MB

Download
memory/3348-52-0x00000000078C0000-0x0000000007952000-memory.dmp

Filesize
584KB

Download
memory/3348-54-0x0000000007980000-0x000000000798A000-memory.dmp

Filesize
40KB

Download
memory/3348-59-0x0000000007B60000-0x0000000007B72000-memory.dmp

Filesize
72KB

Download
memory/3348-61-0x0000000007C00000-0x0000000007C4C000-memory.dmp

Filesize
304KB

Download
memory/3348-342-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3348-51-0x0000000007DB0000-0x0000000008354000-memory.dmp

Filesize
5.6MB

Download
memory/3348-50-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3348-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3348-60-0x0000000007BC0000-0x0000000007BFC000-memory.dmp

Filesize
240KB

Download
memory/4872-34-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4872-29-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4872-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download