mystic | 47203fc7445c1e0e06643f363dd7d86ccc46b70ab234e5fbfe72badfdd6704ae

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe
Size

881KB
MD5

57f9cac20f1d2dea1abe7b8f95275437
SHA1

fb9118f831cf8c9b283ec98fa90d619119545682
SHA256

d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6
SHA512

652b53be10e17b02602401cf340d7b458a2dbd6e9d54641a9682a8cd8fe58fc6fce77bbb4b1926839fd17874d7254597ce02ded499cdc3baf4858ea9e8c13408
SSDEEP

24576:GyDydHoMaeUIsECtGsPYD964moblfbHvL/:VsIVezPiGTh5

Score

10^/10

mystic paypal persistence phishing stealer

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral20/memory/4044-976-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral20/memory/4044-980-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral20/memory/4044-978-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Executes dropped EXE 4 IoCs

Processes:

xR6iI12.exe10KR23AN.exe11BP0203.exe12OW243.exe

pid process

5000 xR6iI12.exe
3188 10KR23AN.exe
5860 11BP0203.exe
6548 12OW243.exe

pid	process
5000	xR6iI12.exe
3188	10KR23AN.exe
5860	11BP0203.exe
6548	12OW243.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exexR6iI12.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	xR6iI12.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10KR23AN.exe	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal
Suspicious use of SetThreadContext 1 IoCs

Processes:

11BP0203.exe

description pid process target process

PID 5860 set thread context of 4044 5860 11BP0203.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 5860 set thread context of 4044	5860	11BP0203.exe	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1420	msedge.exe
1420	msedge.exe
2308	msedge.exe
2308	msedge.exe
3084	msedge.exe
3084	msedge.exe
3012	msedge.exe
3012	msedge.exe
5284	msedge.exe
5284	msedge.exe
5644	msedge.exe
5644	msedge.exe
5608	identity_helper.exe
5608	identity_helper.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

msedge.exe

pid	process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

10KR23AN.exemsedge.exe

pid	process
3188	10KR23AN.exe
3188	10KR23AN.exe
3188	10KR23AN.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3188	10KR23AN.exe
3188	10KR23AN.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

10KR23AN.exemsedge.exe

pid	process
3188	10KR23AN.exe
3188	10KR23AN.exe
3188	10KR23AN.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3188	10KR23AN.exe
3188	10KR23AN.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exexR6iI12.exe10KR23AN.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 692 wrote to memory of 5000	692	d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe	xR6iI12.exe
PID 692 wrote to memory of 5000	692	d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe	xR6iI12.exe
PID 692 wrote to memory of 5000	692	d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe	xR6iI12.exe
PID 5000 wrote to memory of 3188	5000	xR6iI12.exe	10KR23AN.exe
PID 5000 wrote to memory of 3188	5000	xR6iI12.exe	10KR23AN.exe
PID 5000 wrote to memory of 3188	5000	xR6iI12.exe	10KR23AN.exe
PID 3188 wrote to memory of 3084	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 3084	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 4300	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 4300	3188	10KR23AN.exe	msedge.exe
PID 3084 wrote to memory of 376	3084	msedge.exe	msedge.exe
PID 3084 wrote to memory of 376	3084	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3516	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3516	4300	msedge.exe	msedge.exe
PID 3188 wrote to memory of 2752	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 2752	3188	10KR23AN.exe	msedge.exe
PID 2752 wrote to memory of 3376	2752	msedge.exe	msedge.exe
PID 2752 wrote to memory of 3376	2752	msedge.exe	msedge.exe
PID 3188 wrote to memory of 3536	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 3536	3188	10KR23AN.exe	msedge.exe
PID 3536 wrote to memory of 1552	3536	msedge.exe	msedge.exe
PID 3536 wrote to memory of 1552	3536	msedge.exe	msedge.exe
PID 3188 wrote to memory of 712	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 712	3188	10KR23AN.exe	msedge.exe
PID 712 wrote to memory of 5096	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 5096	712	msedge.exe	msedge.exe
PID 3188 wrote to memory of 4844	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 4844	3188	10KR23AN.exe	msedge.exe
PID 4844 wrote to memory of 3252	4844	msedge.exe	msedge.exe
PID 4844 wrote to memory of 3252	4844	msedge.exe	msedge.exe
PID 3188 wrote to memory of 5004	3188	10KR23AN.exe	msedge.exe
PID 3188 wrote to memory of 5004	3188	10KR23AN.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe
PID 4300 wrote to memory of 3008	4300	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe
"C:\Users\Admin\AppData\Local\Temp\d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:692

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xR6iI12.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xR6iI12.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5000

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10KR23AN.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10KR23AN.exe
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
5⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
5⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
5⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
5⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
5⤵
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
5⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
5⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
5⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
5⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
5⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
5⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
5⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
5⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
5⤵
PID:6164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
5⤵
PID:6248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
5⤵
PID:6436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
5⤵
PID:6448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
5⤵
PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
5⤵
PID:6852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
5⤵
PID:6340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
5⤵
PID:6348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
5⤵
PID:7048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
5⤵
PID:7052

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8268 /prefetch:8
5⤵
PID:6564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8268 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8352 /prefetch:1
5⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
5⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6496 /prefetch:8
5⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8852 /prefetch:1
5⤵
PID:6796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,5795133343622239576,13268835485925962511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,13224265822769266786,1131045279946055838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
5⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,13224265822769266786,1131045279946055838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15429809737358739206,8239797587449590110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
5⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15429809737358739206,8239797587449590110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
4⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,15488950541262919732,9145092941596719886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
4⤵
- Suspicious use of WriteProcessMemory
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11049760205566166436,14517560953199867606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
4⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
4⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
4⤵
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
4⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x140,0x174,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:5240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fffd57d46f8,0x7fffd57d4708,0x7fffd57d4718
5⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11BP0203.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11BP0203.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4044

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12OW243.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\12OW243.exe
2⤵
- Executes dropped EXE
PID:6548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4648c3db-da8f-4c9e-a18d-898dd6738822.tmp

Filesize
8KB

MD5
b3124645a0dfa7176aedcb08c14c2565

SHA1
0ece6763ccaf779bf5ce8442645f44884e898543

SHA256
4656ba5777ba3e82538ba7043c7249d2259cf681b4f258942ec2c30d18f62519

SHA512
dac4ac26393ad5c5c0d9f5dc2d220cfb02c34955215e3721354fed45aaeb9986fef83e965fdaaa2f56418e4263326d6ebc6c9f1ea4cafa74bf6f7648f84bf31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a765f46-becb-40f6-8ada-6f07e43893a5.tmp

Filesize
4KB

MD5
9ef4f65f4ca93aca660889154618622b

SHA1
37172b4f06be7d36024d7e019e4909d27e09cc8c

SHA256
47e4119b4abd63f322110586f0017a54b6e995d8b4bf7bcaa8e0220a2925c791

SHA512
89c58779d72af8eb82f571f7e47d12e8cdc035af7cd4cccee7979281d9e74211dedd10c559689a0196a93af1e249dc2144b712d82a424535b5a4b7e7ed0bcc30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7431ed1f-a99f-464b-8133-10adade4273f.tmp

Filesize
4KB

MD5
ef891a6800a475f46dee445345a41f7c

SHA1
54d6b9a0fb9dc287500bf31f61a57534e21bfe7e

SHA256
17322a63ab5915ed82f2720c684641b1f580ea98024c59a4b8de0bda4f73c301

SHA512
7885c51cab2d8e252fd98698ca921600543f440a7733b15aa59c1d49cb79a476fc19a52ec305efca4ff38228c1191b40c729bae4583d79f0fe8dd9cdfecff5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
223KB

MD5
253130eaad29f6b3a8d8e7815c0bd494

SHA1
a4f9c43a0a8bfdea2abb714a89628d9ab53911f1

SHA256
100b51f83c1ebf8717d0b03fbf1752724877a6c3828b30d24dbd649e1d70de23

SHA512
aec0c1d01c6d5c934091913bac199ec1bcfb87297a02237ebb71659dda8040f64217fc21d535efff9ef994085d74c12a7ee6e8ebf711a83f5afa61d765b257d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
34KB

MD5
64af5e859cd411f58ba7ade44f5a8c26

SHA1
c1ccd85a8209e2bbb58c662f1b621d2cdf7d3565

SHA256
7d3be672a50529d4ed208efdb7a90fa467eea5adca9bf877e18b167a4511cc24

SHA512
61ec83ff7512bd438f0c7112111af73b1a6eedd1dbf515dfd19c41dc46e58ea4b998f0faee85e7fc75bbc2d142bbf6b337e52e76aec01f4c6725e9d733765240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3d4853349007d309c4cd83e60fc2590a

SHA1
d3a7d2b0455a783dc037d9ab663352d5dd23eacd

SHA256
115be4cad7b568740f49c9726c2d4603cd3f086abf0304f5985f68583188dba3

SHA512
abf5686642ad0dad76d99e70378af056dda1acabe14b65d25091483221865364c2eced34859251b62971ecafee0c7d05bd751174921ccc6e8198a6314687197a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
e44748bec92a820ebb18b1ee24b51954

SHA1
3a08ba9187e028f5c09e991fc1790579d9e57e8e

SHA256
d2411bd42393507bd36d5fb0126ca879b07eedcfa1959ea4244101e28fd6037d

SHA512
322b8776af2cc853c655189b34fdea477e97c4ca73071e6d934c27785b85c7a93986e27b207c8b493564239df214411b03e32635136ede90129c04ef33dabd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
27b49287e884faa45a495e00eee07a04

SHA1
2019d89dcec5f71b28f7f97e9ca7314b9e7d6461

SHA256
33da161a40e901c2590b14fa273cf462473006e0d3f6111b7c077eb95386c06e

SHA512
d53976a16a5ba97ad72b872edf35f2b7d4386191d746591c8cf5a124b7ff922277d44b0930f93af59036a77ec417bc181c01304f2b4a50989de1b664dd10f72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
05fc62a623878d3ebc35cbf8da12133e

SHA1
bd4f3c5a4fe98fe1c935013032e819655a104554

SHA256
7b00c483761ad88aa9118c43f5ad7fab0cf309559d0ad293972eeb4046372b8a

SHA512
6aa21a03f7f7bb588733e4bbaabca51a9fc4c11495ffc72f68503f91ab00f9f18111b11516f45c45043ae6053f3fe442f7473a6bb6c5192cfbffe540eba30fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d608b0b3231c20470788a135d149e3f5

SHA1
f79f16d62674c56e3e864075531cc1b97f42fcd8

SHA256
b68f17605a5e6d8aec5a599d4f761c83f3763ce13b7f3802c4cc64cc515561b5

SHA512
34c640dd4af4636ac6876d8aebf47f8e0524eb31a5d46028a88b8126f4de7c737861423cbdbbc9d4e23b9f4243e50c22a3fc905241e61abd0759399f2d0bb9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
d5fff90f61ad1f08424b8a1b1b09baec

SHA1
d606f29c434addc0fca298df136501ec50d56a7b

SHA256
6dc740f384fd39f5c217075759528817860c6048c3830b952ee572748c8472b7

SHA512
991f9ec8fc7e90bc8f0b1911581db7630925766659c707737d1e91a62d384199a577e09d5c5a8ee856bd929099c50e6eef938d261fc13887566e4429fe9207af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7916aceada9768aa4f7e30a463d4da12

SHA1
cc7cde7c4953dce059eca90a7f1a2942574492cf

SHA256
3b9db1f6a5def41b95912d330ccb2af3d7c7643379746c4f22fd7d3b6ddc5f51

SHA512
585ccdce756ee593f5124bde1272db0a6b7c84a1d49936e994b481dcaceef0be1dcf71c7d1d8762ef0837da1485de82427e2852b895f7534848d89aa42b8a271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2af9fcdb3a3607afdea08294209b5335

SHA1
1d1354ce6f5735cca256229035a421c0217d12fa

SHA256
da24f4ea3f36c4049e3df294f7e4838562dc7708073083fd1f4f021f618bb4b1

SHA512
2bc6356d37a258f74cb98e8cbb7cc7032ff9b9e88e4f3476acb709bc6436cfb4d092206d2aedfc81b5707c37260f9a5995e98fbe79153e016e8cdc7b6438c9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
9d3e78aaae104b3971d029328c09c9f8

SHA1
857697c021c2c79aac510d6e08a61dcb04447f27

SHA256
ab4ce1835b047b7509bd9e00576d6d6342e9aaacd188247fe74c331629ed45c9

SHA512
b65635a43cbad8036596a2059e6ea574bed58b07c6f47153e542df91f8e15fa348fa81e17dc3d2ad299f725a6facb8df70b93842378bd10ddebc9549d435f970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
ee45b2505c41e3dcdcfab396501eaa33

SHA1
e2cc5c5089d72f1c5e35b8043c93e882fa2f6838

SHA256
ce2151667d2a1f26c94e6daf8e66ea838b0de51071553cea2e1647b56d95f91e

SHA512
532ca746ce758331a92f6a03a26f0150be9696833ca28fae879f9901f9494d55a4e84ac5eca414d764449048616cedffea3c6bbf551111ba548acb8cdb7199f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
e9d76cca50e3c2262ecf3ffb46798112

SHA1
8a29a21d178f35a126dde6606baafe48700dd2fd

SHA256
c4cca6ef0acd3bb6c7e535432ae399c7225af39e718b963bb72fa3785e589ece

SHA512
b176d0e12af70e65b9471f94a0123e275812820d3871668c62993758e39c42965ed565ad546382a1285bd3c8c3598ec0e0682b1e1fe5bac16eb0cb5ad308cf56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9889d5e8c0467716b347f94c3afe1a2a

SHA1
f83fad9a27c6d1e0f2939cc03af6567874f83cb5

SHA256
57094406fa8ac5307c6fcb5a5283f56646c4bee3054d72c67657ceae965a67a0

SHA512
fb57aeaf3754cd46e0fc64eecf72bbf8cea427d818f232edb799f8a68f7dfc1f20f6e3e751ad5045c01f320e253bbd07d48dd7b7e5c492496410cfd513c87eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f0b9.TMP

Filesize
48B

MD5
c20f4eed2058154a28629b0445854a67

SHA1
16e3c0ab6660f915b9ba125190539811b70caac5

SHA256
58bf869ea5c444cd14f4f8c898958ed5e3f8f7dc5705f01e2c40b963e2507ffc

SHA512
79bb421d8f09bb664a81837d843e65245215fd57950e64857a9c9d52ae05d99b7a0beaa0274caee24fdb37ca1a8cba6bd805d142d574b2e4707832b5dd4d972d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3d03061f16db8bcdaac37379521bfa4c

SHA1
263bb5405916f23082ad1ebc723020f186c2e7fb

SHA256
7e26d81e55f0b7b8b9b084fb75e0312bce09cc273ee9e1b993b5abb7c781de6a

SHA512
2a9809de2d3382cbb74fe680dfa65f2ac2936d1a07692247c11bd4dfd75439cbf5d2ae325bf9abae8bcf3e832ca1be776bc5f6f79e431179bdca4de606e30a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
07dbf4716837ecb5fd063c461675c9d3

SHA1
5172729cd5bf221ce79ce79093be85818e6f5dbc

SHA256
9f6c2ced78480453dfd6e6fb71bb85c5cc555a015804bea1ff277987006a8843

SHA512
47f800133e6ab3b5e6003f33dd9c6804cc6b343621c701758cbede1afa557201ac1b65ecd5d60062b2df07e023718c276485521e375e83aa7099d10387d6f820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1b4e7ec14e515b85e2e61474cc5daa1e

SHA1
01408d19b4e7eaf9179bf818f5ee935b8505bc33

SHA256
248baaaebceb1460590b62e760a38697b47a6a7b64ab2ec5c32a11d820747162

SHA512
09c292815a8f333dbdb8d4d3e1852b81685b36b5d61f3209d4f5f3533530b268a833dcc5ab5259fcdef9a938d739275763e49a81da7bea69dbbc31d54430f6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57974e.TMP

Filesize
2KB

MD5
5d1c765c12e327eecaf608c0fbff0266

SHA1
3a5777032193222b14bc3e8ffe99efad8c6d2c1f

SHA256
3cd9246c07e64234ed3378ff0a6087e1bd347748f9a48985ac08ee3efcc74d07

SHA512
b4fdd587d5354e51daf2d943759a8fd4dafda56f959aa05577e096bafa2f76869841377d3407c4839a60cbecc135eb1a36fd2c7a5e3868327406f8d346f6295f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e22d5c0ea228602a05d10d7ef868df8a

SHA1
17509707aa79eb7b08d9360267a150853b5ab9a3

SHA256
2c3747c601ac46e5319d4cb1acd7aaeeed0b4baa5ec38281492050687ed123c7

SHA512
2d39168a561b78eb5fabfa22ae5c3eb746d68abc8fad37ba7ae41575f9be2eeb01be5b62b458c3629dfcfff27d88a0d942637ad4af9c9f81a0f86f60aa2c04f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9158ed481485286111346a78653b833

SHA1
81514647543ad646055ad6ecb1d0fb68a0d75fd2

SHA256
5c275f15b94feec9b251fe0d5fb439fdff8014444487319f75dc89d03b3933e9

SHA512
29ca9abdc6087b21ca3a487ec1d07f4b8b38963d3cca6f344b27da64d13ae05eec95664b067bbdfe00e70d0206287daeff249466f0d8c08f333be463bda5c32f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
aaaba26e595e8c779f52d6ffff57c6e4

SHA1
f42d8cd4893d4b19d354f26cf23c105785acc85a

SHA256
8d3acc819a0fa7307281328b13a53bfadd562c3a89ae175a389014a5fcc5cf1e

SHA512
1aec7526f31a6183133da041e0ceca4a57e10fa8df958f29bcbd464b84769a687027a32b5ea6926eea4325fc5c7e0675976d4b77ae13b8c038308c1622e7c7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4c95a78d226994b1653fa3b78e647816

SHA1
85154a76303c39982c5a58af1e595868bdae01f5

SHA256
19ab64a76c9d03fae27bfad378300513785a831e29af1fa2d4a2a03badeed32b

SHA512
b7018daa7cc353e9f6359bbd26730b6ed624d15fa2e2b83b3a84bd42da08e471985835e6d68eec46ad20eea03ca280062cdae3ea8bd8f4dd4b1d752b6e0718b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xR6iI12.exe

Filesize
658KB

MD5
5166c449d9ae5b5749d0d6d795829598

SHA1
7c03c8f0201068f235e3907bff1d6393a869eb0f

SHA256
c9ec75e3dd7f7b032cc16c171a479a4809a4d43fff59ae883d7727c12f5a8061

SHA512
bcb1b872a3c73cb74f82a6d127ce362e582e462ef7021fb3e2979f589c8ab07bb3a5de9ba0612088d4adc37ef68a664fc2c687d90a80e3c528b8e22653b8f0e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10KR23AN.exe

Filesize
895KB

MD5
ecbd7edf5356bd490e887e8c013c4aa5

SHA1
a74e1aa639c788e0005d2b1bd5a4f0d6384238ae

SHA256
1f0b81e4e4bdd3015e7f89ef0f9f94f75faaa3745397018337f9b7a190df0bf9

SHA512
08e266a5cabb3637ad54e6663b8f4fde08acb8fa10820d5be38599e372892635468662e1dfa76d2a5a08bee1a6b653123b7439fb89dfd0c0b620e54ba68d97c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11BP0203.exe

Filesize
283KB

MD5
2e7d938e29cffd6a6c4a3034dfeba741

SHA1
6afbc69c5a2819158ed036c5ba2b4b026851c059

SHA256
1825ca3e05379b28df1427e7bedf5bdd97849e010bf70f1165de6f028c5c81e3

SHA512
4e4e5692ff3961175b974f657c2ee700327bb07ba214d5206389e4aef70ce02abbf48f8d6d2e11f720b3ec33cafccf2d4d9b0c3953c1aef6d91d1e4f06669e8f

Download Submit
\??\pipe\LOCAL\crashpad_4300_IVNRJGAYCKINKDCH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4044-976-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-980-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-978-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download