redline | hxxps://yuqucheats[.]com/cheat/for-4075[.]html

Resubmissions

14-05-2024 09:38

240514-ll8g1aah87 10

14-05-2024 09:35

240514-lkm5nsah33 1

Analysis

max time kernel
145s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://yuqucheats.com/cheat/for-4075.html

Score

10^/10

redline zgrat discovery infostealer rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4264-462-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4264-462-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

Yuqu v_7.98.exeYuqu v_7.98.exe

description	pid	process	target process
PID 6216 set thread context of 4264	6216	Yuqu v_7.98.exe	RegAsm.exe
PID 6348 set thread context of 4516	6348	Yuqu v_7.98.exe	RegAsm.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Yuqu v_7.98.zip:Zone.Identifier msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Yuqu v_7.98.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeRegAsm.exeRegAsm.exe

pid	process
1132	msedge.exe
1132	msedge.exe
4716	msedge.exe
4716	msedge.exe
4700	msedge.exe
4700	msedge.exe
2244	identity_helper.exe
2244	identity_helper.exe
2648	msedge.exe
2648	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
4264	RegAsm.exe
4264	RegAsm.exe
4516	RegAsm.exe
4516	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs

Processes:

msedge.exe

pid	process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4264 RegAsm.exe
Token: SeDebugPrivilege 4516 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4264	RegAsm.exe
Token: SeDebugPrivilege	4516	RegAsm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4716 wrote to memory of 952	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 952	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 2096	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1132	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1132	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe
PID 4716 wrote to memory of 1360	4716	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yuqucheats.com/cheat/for-4075.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95eb93cb8,0x7ff95eb93cc8,0x7ff95eb93cd8
2⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
2⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
2⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
2⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
2⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
2⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
2⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
2⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
2⤵
PID:244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
2⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
2⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
2⤵
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
2⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8716 /prefetch:1
2⤵
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8952 /prefetch:1
2⤵
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9100 /prefetch:1
2⤵
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
2⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:1
2⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9456 /prefetch:1
2⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:1
2⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9944 /prefetch:1
2⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
2⤵
PID:6692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
2⤵
PID:6764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
2⤵
PID:6840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9624 /prefetch:1
2⤵
PID:7152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9740 /prefetch:1
2⤵
PID:6644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9636 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15063370530638665437,931188708693170615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6972

C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe
"C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe"
1⤵
- Suspicious use of SetThreadContext
PID:6216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe
"C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe"
1⤵
- Suspicious use of SetThreadContext
PID:6348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
2KB

MD5
661cf82d7ff5c760912b43f583c59aa5

SHA1
924bacd9bb4e0f5f985b4f98bcd4a83a46775497

SHA256
e85f98a486bee3b77e4c15d304d2209d3944ec6e3ac2faadf68ba176edfa64ae

SHA512
44db890cc597390afd2b529af490e0835d14ef703eba6488720524666b76aedc02c7d17977f6c115474b6639ffcce409ebb205deb182b08a48fe5986109b616d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
edc59f0e6cdb94132991be46e6a1bf30

SHA1
ea5de6aa313a7fca385da74e372cf3c833538d79

SHA256
59672273b6e79267d533fbde640b783fa3928cb0d0222ed6deb6e5d985252548

SHA512
cc98535225b00c8feda6c95f0018d821a2e88892456fe67e4d90a3f15f94506c584f191f769a75c87cd1429ba079124f6fff14239e5f9d8b6e530f79d9940aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
16744cf98467d0272f887c3d4bdcbc8b

SHA1
7d227c0dbc6c484f4665112e366700f5b0c7f99b

SHA256
7af6084d2ea05b1854ad867677384713b7fb871819eb4c8643cbb343adb02b2d

SHA512
b8d5807a581a73e84e5a09b028f15612061733e2a0a4d36a13b1eff08ff044cec44a27fbdf7af24422033b20a9ac8e048752d5d87c060b39cc5917db23a11724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
40KB

MD5
922ba13efebff624a0de0bbe7226b240

SHA1
8e82ca8e313f76512f5ab1a4d68029931c533b53

SHA256
69df6142bae6d76b330972c4807f6687f34e002854bdcd1480a26e4dcf79eda6

SHA512
2a65d6ba093cd06309f9676598c83c75c26f2a2cecfd355950aa51c89b729140a1d85fc4065564c914630fc808f3084e2dc5aa38ca5093b8ae8fdd2da382c09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
10KB

MD5
49bf52bae0b96cb08326f88d9e3c675b

SHA1
b5a6dadd397e6d456821388bed0e8e54ce59929b

SHA256
4a572913868ca2f6048d837eef9f0b2102f61d1616a3e68e1d1f2a3e2eb24bab

SHA512
4fde8f466b8e82b5395fdb581706485d6a8e38881d0db12edc1a06459a803e7305342bff21f09ad2b9e145397d84615be5373ffbecfef525cc8dfef5079b209d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
318c1b0b60a33aca0a2d16bfc4547cf5

SHA1
b8e2c5be66ad46a1f954d96dc71ea0dd9d80b6dd

SHA256
270cdf7925095a853651c3db04553b011fef88d85235b3b3ba1930e0e775cea2

SHA512
79231a0903e41c78e80e5df7478cc00c4166c8bac9cddb8cd0867070920f39366c47a9454afa03ab529310f5f73c2ce7b246e39293163061a395606abda7f64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
9a47bdd6eda891ac64ce7ac54e842bfc

SHA1
789d541b092c6c0de13f9b18b3fa5e755b429af0

SHA256
ba05a55bd8cf37d11f587638c437ac7d33417b5631171ad748f5f118752d1fc6

SHA512
01e0c9f8910b7d1c06ef248b241ccaeb097ac72d4a0bd455425d7c074cccb55eb33a060750069976a761407cdfc18d4f3de9dcc3432018c63af9534ce4b91ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
d884810e8959e5f3e2d7ed2b4d0b53d5

SHA1
89d65ad49c5b5c4cb8eabee4b53337d146000614

SHA256
afcc02ac58ebd2f659476d04ac96657e30c4e02335e437839a348d80af8a26b8

SHA512
79b73482929577ae01bca022d12259618c3ab55b1a9393f855b7d8ada2e2dd2b72d836c47c96f9a61d03d6fb18cd3e60e4e2a91087295c3e677b3ec1d0ab5c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
2907ccab13eb8361e09bed556da3a7c7

SHA1
5d41e06ace1dc68546b3308c2b03c3d9fa26ebbd

SHA256
7dc427188e825035429727036ba396f785df6ab586d002b87603072c2c96deed

SHA512
047aec39463b20226a165dd0c873f6058bb312ecff1d493c6e4bdc337c9002e15ea7799b10a9ee9e3d951339366cf2bc627a74ebbe1e954074ce8cdc04415999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
75278d50b28f43c171ef19233aa8ca09

SHA1
2b53609cef61d1927609341d13767ce555211712

SHA256
cad928e99966e6aa16043846ebeae152208a368484995d0c7f40c84cbbb4e1da

SHA512
cb5f552ac7d05eb07ce9028ed666cc3c24db902ff3c2ea2984615827918da2c0168e880d48a069509cbf6771ec0e70fae2746f2518eadae1391ed65a618d9c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cec9.TMP
Filesize
2KB

MD5
306027c8208da78fd7ee58a1af4822c3

SHA1
fb3839962fac7900da9c5dcdc666bcb2a212b09c

SHA256
25323432f7ca041f17ec920d9d7ecc8a1eb2dcde1abd85f2fe5c32603d987509

SHA512
2f4f37ad204cd13fe4b594722cf62283a5a5da869093d1a1afb59f4a05ca82ceae340358c36bb650e7dda736435bec171d9b687068c9dc0d8e7642762a310d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7dff059ce28bfc7bc6dd51cf0859c191

SHA1
b28ed362f61f680b5b666a6a797cea9f36b0efe4

SHA256
0a73fded3c5f36df598427720ce11bf4ce35572fac020d1655c96b1a8af9d218

SHA512
c5800c4512b1a52e5a28aa7b31e7d414c0c0e7b685a6146371790b86f4c94e3eebf03e60baca6d61fa3c72cae0b21281003ff7c0a50b4442d3268fe9bb9442a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc7ce918-3dbf-47c6-a648-4d06912ef406.tmp
Filesize
11KB

MD5
32b94678c293ac8f0dcfb728d51e5a08

SHA1
c8fcd8cef45606c837861584a62d203f18de277f

SHA256
9a106329728adf9493d9c2ed47de6045e3c6034064bbfe3f35908c269bf43bfa

SHA512
33c26b3190a2f283dfcf2c6f5ad1622176f232d130a2901aaf57349470f964093f8bdbb9326added06a6e7bd66225edfb93aa40868af0740c22802dc1895ec46

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7DD4.tmp
Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7E16.tmp
Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\Downloads\Yuqu v_7.98.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\LOCAL\crashpad_4716_WFZJYWAYYIMQLRHT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4264-470-0x0000000006220000-0x000000000625C000-memory.dmp

Filesize
240KB

Download
memory/4264-474-0x0000000006720000-0x000000000673E000-memory.dmp

Filesize
120KB

Download
memory/4264-467-0x0000000006740000-0x0000000006D58000-memory.dmp

Filesize
6.1MB

Download
memory/4264-468-0x0000000006290000-0x000000000639A000-memory.dmp

Filesize
1.0MB

Download
memory/4264-469-0x00000000061C0000-0x00000000061D2000-memory.dmp

Filesize
72KB

Download
memory/4264-471-0x00000000063A0000-0x00000000063EC000-memory.dmp

Filesize
304KB

Download
memory/4264-465-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/4264-472-0x0000000006520000-0x0000000006586000-memory.dmp

Filesize
408KB

Download
memory/4264-473-0x0000000006EE0000-0x0000000006F56000-memory.dmp

Filesize
472KB

Download
memory/4264-466-0x0000000002CC0000-0x0000000002CCA000-memory.dmp

Filesize
40KB

Download
memory/4264-476-0x0000000008E10000-0x000000000933C000-memory.dmp

Filesize
5.2MB

Download
memory/4264-475-0x0000000008380000-0x0000000008542000-memory.dmp

Filesize
1.8MB

Download
memory/4264-464-0x0000000005830000-0x0000000005DD6000-memory.dmp

Filesize
5.6MB

Download
memory/4264-462-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/6216-463-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/6216-461-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/6348-532-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download