mystic | bd5cb5ed04f67f5a6f2f5411e9ad5c457c0c3e3bf3a38e4996624bdfba01d98d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Size

1003KB
MD5

d633ba16a6a77e63044fd70f886471d3
SHA1

41da78358e41bd6d5b513cac508a66d913a35158
SHA256

820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb
SHA512

b2439af134ba4ea592b46473f98a8ea16b2fad4af5acc4dc4e2cd2c977a54e454ef8e976654a0cde4d30883b7284970b7edcbfd3a13f371656b7843af8012aa8
SSDEEP

24576:Wyo4MtnVpaekIsZClGVltDwkbhRqc3LNDj:l/eDusGB7bhbN

Score

10^/10

mystic redline smokeloader taiga backdoor paypal infostealer persistence phishing stealer trojan

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral10/memory/7108-190-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral10/memory/7108-198-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral10/memory/7108-196-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral10/memory/4580-866-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 6 IoCs

pid	Process
4592	KJ9dg91.exe
4588	hZ5tb87.exe
4696	1OH45hT1.exe
6480	2en2870.exe
5168	7QI11ob.exe
6572	8XM435Ts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	KJ9dg91.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	hZ5tb87.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral10/files/0x0008000000023480-20.dat	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6480 set thread context of 7108	6480	2en2870.exe	139
PID 6572 set thread context of 4580	6572	8XM435Ts.exe	169

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
2344	msedge.exe
2344	msedge.exe
2036	msedge.exe
2036	msedge.exe
5220	msedge.exe
5220	msedge.exe
5336	msedge.exe
5336	msedge.exe
5988	msedge.exe
5988	msedge.exe
5336	identity_helper.exe
5336	identity_helper.exe
7760	msedge.exe
7760	msedge.exe
7760	msedge.exe
7760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4696 wrote to memory of 2036	4696	1OH45hT1.exe	89
PID 4696 wrote to memory of 2036	4696	1OH45hT1.exe	89
PID 2036 wrote to memory of 1480	2036	msedge.exe	91
PID 2036 wrote to memory of 1480	2036	msedge.exe	91
PID 4696 wrote to memory of 4780	4696	1OH45hT1.exe	92
PID 4696 wrote to memory of 4780	4696	1OH45hT1.exe	92
PID 4780 wrote to memory of 4988	4780	msedge.exe	93
PID 4780 wrote to memory of 4988	4780	msedge.exe	93
PID 4696 wrote to memory of 3952	4696	1OH45hT1.exe	94
PID 4696 wrote to memory of 3952	4696	1OH45hT1.exe	94
PID 3952 wrote to memory of 2936	3952	msedge.exe	95
PID 3952 wrote to memory of 2936	3952	msedge.exe	95
PID 4696 wrote to memory of 1676	4696	1OH45hT1.exe	96
PID 4696 wrote to memory of 1676	4696	1OH45hT1.exe	96
PID 1676 wrote to memory of 3712	1676	msedge.exe	97
PID 1676 wrote to memory of 3712	1676	msedge.exe	97
PID 4696 wrote to memory of 3220	4696	1OH45hT1.exe	98
PID 4696 wrote to memory of 3220	4696	1OH45hT1.exe	98
PID 3220 wrote to memory of 1064	3220	msedge.exe	99
PID 3220 wrote to memory of 1064	3220	msedge.exe	99
PID 4696 wrote to memory of 1764	4696	1OH45hT1.exe	100
PID 4696 wrote to memory of 1764	4696	1OH45hT1.exe	100
PID 1764 wrote to memory of 4468	1764	msedge.exe	101
PID 1764 wrote to memory of 4468	1764	msedge.exe	101
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
"C:\Users\Admin\AppData\Local\Temp\820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        6⤵
        
        PID:2076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        6⤵
        
        PID:1476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        6⤵
        
        PID:1800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
        6⤵
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
        6⤵
        
        PID:6052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
        6⤵
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        6⤵
        
        PID:6224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        6⤵
        
        PID:6528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
        6⤵
        
        PID:6704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
        6⤵
        
        PID:6844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
        6⤵
        
        PID:6996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
        6⤵
        
        PID:6600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
        6⤵
        
        PID:7152
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
        6⤵
        
        PID:6856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
        6⤵
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
        6⤵
        
        PID:3284
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8320 /prefetch:8
        6⤵
        
        PID:6080
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8320 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
        6⤵
        
        PID:7380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
        6⤵
        
        PID:7420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8564 /prefetch:1
        6⤵
        
        PID:7428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5844 /prefetch:8
        6⤵
        
        PID:7764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
        6⤵
        
        PID:932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 /prefetch:2
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3578562249980140254,7103315123376210775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        6⤵
        
        PID:3116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3578562249980140254,7103315123376210775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,210475167593367205,533988084229298856,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        6⤵
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,210475167593367205,533988084229298856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:3712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11532272958695681981,15707209495789207819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        6⤵
        
        PID:5208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11532272958695681981,15707209495789207819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7805015465882138951,4860238780019544625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
        5⤵
        
        PID:1376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:2596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
        5⤵
        
        PID:5480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
        5⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        
        PID:6244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:6480
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:7108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8XM435Ts.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8XM435Ts.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:7644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
72KB

MD5
549ff996160d606c1d0a7f42fb580629

SHA1
86ddd654b30c3d0841aa03cb2047136fadec9450

SHA256
551caaef94034528e8f8df2fe7b011f424b2b230554a358552b99eb6441e6f47

SHA512
035c4d3b9c46066b786571ad2d05865a2f8108cb387b3451128ab618f4be77c495d0a4dc6febc565bbc37f45d77f474f6a2c0544240e3f6b097714de6fab43a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
34KB

MD5
64af5e859cd411f58ba7ade44f5a8c26

SHA1
c1ccd85a8209e2bbb58c662f1b621d2cdf7d3565

SHA256
7d3be672a50529d4ed208efdb7a90fa467eea5adca9bf877e18b167a4511cc24

SHA512
61ec83ff7512bd438f0c7112111af73b1a6eedd1dbf515dfd19c41dc46e58ea4b998f0faee85e7fc75bbc2d142bbf6b337e52e76aec01f4c6725e9d733765240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
223KB

MD5
253130eaad29f6b3a8d8e7815c0bd494

SHA1
a4f9c43a0a8bfdea2abb714a89628d9ab53911f1

SHA256
100b51f83c1ebf8717d0b03fbf1752724877a6c3828b30d24dbd649e1d70de23

SHA512
aec0c1d01c6d5c934091913bac199ec1bcfb87297a02237ebb71659dda8040f64217fc21d535efff9ef994085d74c12a7ee6e8ebf711a83f5afa61d765b257d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

Filesize
132KB

MD5
3ae8bba7279972ba539bdb75e6ced7f5

SHA1
8c704696343c8ad13358e108ab8b2d0f9021fec2

SHA256
de760e6ff6b3aa8af41c5938a5f2bb565b6fc0c0fb3097f03689fe2d588c52f8

SHA512
3ca2300a11d965e92bba8dc96ae1b00eca150c530cbfeb9732b8329da47e2f469110306777ed661195ff456855f79e2c4209ccef4a562a71750eb903d0a42c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
5KB

MD5
15e87605d4aaa2653439004b63e093ea

SHA1
48fdfc39a43cee0fd7855db7fc555ba641e63ed6

SHA256
3163b5e1ac4fb852cd7df8917030bc3934ae539cafa46ad75aa4432e55050078

SHA512
c3e28fe3f2c08c533d78bd24e9a6a137cef5da8aa74447fdb55c4ccbf86b13b27280712d94429dd9db33eeec679750431ca8fef0254a49fad033a540ab7f34f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
5e6809ba7863bfee50aaa421da9a97f8

SHA1
76007f128e43131b61773d8c27c1a0954e9697e8

SHA256
7d50bcc38c5e62f92fda5dd5dea579457a02b72f1ba6845ecee1337c5b0df177

SHA512
d65d12da05f3e195f87b5eba3b6ee6d3f8d9ee30f79f3eba931d9e198f7a7f8152ba70c215670e8f77fe4925e63b0c55c736eec83baef7f66247f5faf5179dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
05ab5fe2f5285e7d0ba5c2859ee8739c

SHA1
9447df19cc00a790998c9e3a98c3dc5d282f45c0

SHA256
d9cd8cf015d35c8c1485519e4c8314854b1cf9ef531b44ba0cd2362a71d08bf1

SHA512
e36a4785841311b04c3d6420e15ffbb084e1e4fae26ba462752000a6bddcd46816271b089e5a623094e695a5bf27763eaae2cd57afa783ea702f70f2137bf395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
35e4cd83f0fe7cf74aaead294a4abb86

SHA1
0128b24f28793f9405d4688f92a59778ad3f4de3

SHA256
65c89207045577b891a27c4ecaa03103870ee8061093049e88fa80e8bea6c5cb

SHA512
ae3d2e13c10866b29c7459faa21290ff29e751ba8613f724be98fb3c536a5afd9449940a48f53cec649d63dbbc4de0974adda6d410356b652472abb0c999d7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e419b6c144009d69427cfd168813e98

SHA1
63bcfa98413b833d45612cb45e2540df4bba8fe7

SHA256
9ce65d0d56304e82d30bb5fdee3286475ca1206b5a702b1a4c3f4084e69a0579

SHA512
5c8fc554e35188de71848d53478558ce99440bc453e1c15c62eedf99fd6c6607db7e530e6c887eb82b83e4f07cbe084e35899b6bb745c3e78f93dbe325500cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5c2c59e1a5be2427c7f55836ff3f9b2e

SHA1
0f0cb4d67b06fad09a11bf0d02ed0768e5b43f10

SHA256
3da0a4265639ae34a5f74adb0da66bccfedb9f6e364a129b5b36977abad8b54d

SHA512
8918034f53fffba9d4f142dc2bff3df42821e52627481d3e49a691a717807878410985cecf28aefa38a3fe8ac6e8071f6689633cc5929c175a9e3dc498410a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4589adb5337493cffb8a3c6145562d84

SHA1
dc2a52eaeee7fb0fe3e73ade28a2817065160693

SHA256
da92acb5f4da2133070fabdea608a12c189cd24771b1ce9a30e8a538b4092d7c

SHA512
7432eed3b2ca35759beb35b8d7b8a45bc3baed92eb652241e90209c54620b5338d825af6b68e77459c8e8b1a00685f5e01d19e3a254ea36d4fa46f07ddb07173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
c357a95ec0791f9f624fb66fbcef4b65

SHA1
618ef02e66946deba17e15375808250e391d7aca

SHA256
daaa4a2adb0155311875a899658bfc0ca8a28da32ce437bbfefee6eb7a83a72f

SHA512
f6c1b921670a8ec8d6547e56f18bee653d822a13feb3b9d0eb5f9f9967dad49cd104c6f0a4c8579e91e8f09599158cf10abf681b19409658ec033e87c65539ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
3cce1f16c5e91c45b086e6f7109a55bc

SHA1
bb2cf85b439498ca69cbe1d9548f49d1d99fc5d8

SHA256
447fa90fd0537de6cfa1d2bfa1cbaf91742aa2236397a353c40f42c1f656be0b

SHA512
a1e515802c0c554317100777c0d88e3413f4ccad76cf09a9fb470bb030180368939460140f1491ed9cbe83be4b9c8e567bb7f692c674913680e6ec2dff131756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
c7a7b4f1d2d1ccfa25317880dca6d3c9

SHA1
ea086f68686d951ef5a83e6a0d2fe76345e62dfb

SHA256
df4b9e43ed8029f4b7143d779d4352442a77c80a31b024903b1590a9b99516dd

SHA512
271d976e8036fb142809a77d0222f45c2d28285861568feda939f24de792c81381c6659ecb1c5221c41982e2dd741465d6c1f179993a08e87d8eaa7203b4dce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f63e97a9c8659e0b1e02024db7bf36ca

SHA1
03ea6b80a67c49cd64acee06a7b7c296a7c60af2

SHA256
a4ee1a198b4c88746c63ded8426076f84115958f887679f73346f886cd2deb39

SHA512
61b0b30ebfc67b7b5e03492b029ae39dfea30c0b96e089e82e86a5422f3bcb3f87834809ac4da7cff437a1f77b7a1bcbb92723e65e17c7d6467a7a8a7c166568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f83b.TMP

Filesize
48B

MD5
365f650a1275d7520564d5dfd5da1c23

SHA1
e70a7b998ac0caee37c442a58bbedd5dfebd9703

SHA256
9c28b0c0ac4ba0469c4ad5837981e6b3438fdec5fe270bc1187d751c529efb66

SHA512
57841297825ac12dca4d8b79a71fdbcf5dc246552e1ba26b977b176c7cf5a045478349781ce7d49137a2210aa19749e3cd94f846b24e6b39d439a005f9bff0e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
44a2d2e58e72c6e54d692d5e41e772db

SHA1
0951066d63041259a8fb68f326e58fb2ad3f5194

SHA256
9f9cc34b5cb6f4d46841f173c49308e45b28a921882f827e796caa4b8933d3d3

SHA512
1a11ed9c22462835fc718b60be25f2a9d43dfdb0fa675948cf6c3926d07e47d909659f3307f8bb40c4e73c2afb4ab8b0dab70f4222613ba9706620fee0da0313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1603748c5f0a8ae26266720fc39b72f7

SHA1
3e4e75ba7f25a66a3781a78935486f9f3380c37c

SHA256
ec01c3b461f23700598ce47eb311205e3ff8a161f2a659e717cb107e645ca179

SHA512
44e30bb0bf2ab67c7573be90eaa098401e9534f53fe9b2c07b0cb9f56dd42151e2dcc0083d2e56b461862b0107616b88bb5bf0af70c71db7905dacf178d27580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
84ca65f1f06bf1fbbea48c6f70184b7e

SHA1
5df79550843c3baeea18a1ef1c7f53788b1501f5

SHA256
9bea881b5977782c878d9d0521dc93ef2075acce0ac78b0833e9856bdcb12756

SHA512
10e1e4ac36140f574ee8b2d31f30eea1ac624bd15eaac5e6895c841e0cc1dd270fca73f0f2164aaf5f6574eba75ba4f6a0192be7b99130202a5f8d6d5bcbac1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a400.TMP

Filesize
2KB

MD5
12f19a9f3258ef56d220d0df1fe49413

SHA1
9b1b7868b215c0513fc9c8979f0f1b612a178b76

SHA256
d16c370e28a4f2126e5104e351ceaf914037f0121c5901f9a3191be7bcfcdfdb

SHA512
47c184a66bfef2285c9b806cc2c7ff2ab6c63bb37dcd4c46e864a7ac2e5c3795c001fa336429c0f04d086d1386a3396b19cb80bcfcdbdcc873b46a5c2ffcc898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
673aca9b82e7889f4f240e1c212addb1

SHA1
9bdf8b2a36e5b156617a17d19b95c23910811a24

SHA256
1b6ecccefd9618a53e35f7dad0945aa3a4209ba7fdab7120c671e9bf9ffb616d

SHA512
5d9eab05972c0ebf1859a20872e786b6cd509c92d86f0a2b8383eae738194fd268dbf99cec91a4d8d0722dd76c4faef7b013fa7ed6df62e51bf83f7a3debd64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b6c1e87d834e2d5f2b6a24cbad6e2a2c

SHA1
247b24e7142fc469fc4afbc41eab60ec75d8de66

SHA256
afe491e01a7fc2c07d8131bc97e73390fc2405054627a1bddd4f52b3e7dccd94

SHA512
37721d5f802b9e120de5fa186d3affe9c7ef6b07bf93adf66da8c2cd9770cae5b9ff98601a03d6177656c5227bf16712853b0b9ae3c638415d77b2762f06645c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a18fe92ae221b7db2979a0e0da8b66c9

SHA1
f26e5c9b5aee3fb1d2c9ba7086c0cc233244ba81

SHA256
ccfc481840f1e0303fd9be0aac9de704783cb10865add67a076f414019d95e3f

SHA512
8a066bfb4d1ba2a94ac4234b125cc36eda57da7ed45de3dee7088a443c113f7a54945ef93399727083b6e7ba231ba9715e433b61d8e2eb9647e2abd3a3c1ddba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0453b958234923be2b0bcab9d5cd5e4

SHA1
71fdbb34e5fef77402ff391ff28eb8571a61c243

SHA256
6008a393556bcb2298c63705deae0c885f8c35305ad8196e98ea7f25ddc66ea0

SHA512
9d206a734d2c2006b2b5a4bee0b83be63083f458b8bb5b8eb3955186d5b92b002aeafcea2610d38f46c6a402b57e9bf06ddbcfc02fd01c164885aa1bd9f120a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c6cef57301e59b7588060b60e0d6736f

SHA1
256fb5aa8e1043ad44823a15472df290830b7339

SHA256
b133cef90c2d881527e310639e8e83b3403e3e088efe819a987d5b0fe5c404ea

SHA512
522c95d9ed554e3b883c694b7e9b902df051ec0060c441fb53ea7c5672948cd65bc31e9887f0230a5dd64472f91dfa1eb797321a1b9c164831e370a80dfcd93e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe

Filesize
782KB

MD5
d561c554c59dee7d21354c23242ee95c

SHA1
0b5452c70c0b16cf8f7740c946c131575f36daa5

SHA256
40ed5d446543e30361a0f291114ec7f7f96a85901636e529c08eab9bfa5be33b

SHA512
e0053496d2330e498484a8a560782ce0e349731d751c8d32e79bd00283e93ef9185a0a0ed3ac91dfe3ba3fbde8bde60f037a18f6a1c7b4cd385704aba54a129e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe

Filesize
37KB

MD5
b938034561ab089d7047093d46deea8f

SHA1
d778c32cc46be09b107fa47cf3505ba5b748853d

SHA256
260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161

SHA512
4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe

Filesize
657KB

MD5
9641880aad3e0bb627c94584a0a5c467

SHA1
5928e4ceb0e68276195451fccc0af4b55cb2ac20

SHA256
97dbf3cbbcd04069727b3851c47f247a1a485c565aff956ce66805215727efc7

SHA512
bf227bfdb890bc488ca59191cae6dec74328851f0fc524768d616dddf67cc82166010551d26d1ce12e86b0204ad3d7d834521e46024dd32759206013fa8224c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe

Filesize
895KB

MD5
411c187806134566299f3e66e80ec273

SHA1
59f3c2b53d55a3e5aaeae08b246b56bf9ec4008c

SHA256
1b71157011fd8e500986f1db88a29e36a1b4374823e151e2ed974b9f36dadb0c

SHA512
e659a92bab316a5e9bdb0759cb4f02efd26d553fda3f5d3325a088c798ac4e4cf52195225b01c63b0925d3d7b6aebc73dbb3b8ca1837495063edfede6f66ceee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe

Filesize
276KB

MD5
149ac39a328cd228354ce5fc7859995d

SHA1
696f1f62db6dacd78507d15a11f923890ce026ab

SHA256
cc883fa0cc0b0f426d286d1f7b8dc5f28ce6bace2e6f7e99202ac1cfd76055a8

SHA512
ab32ae42ff5f22578476e11e815d78c5d782e86e89aecd4b4f34942cda9a7f65036a355f54820420bc05c811ff286e1cb1addc594c9b502459bfabd9a78deb46

Download Submit
memory/4580-869-0x0000000004BC0000-0x0000000004BCA000-memory.dmp

Filesize
40KB

Download
memory/4580-868-0x0000000007610000-0x00000000076A2000-memory.dmp

Filesize
584KB

Download
memory/4580-870-0x00000000086B0000-0x0000000008CC8000-memory.dmp

Filesize
6.1MB

Download
memory/4580-871-0x0000000007940000-0x0000000007A4A000-memory.dmp

Filesize
1.0MB

Download
memory/4580-872-0x0000000007800000-0x0000000007812000-memory.dmp

Filesize
72KB

Download
memory/4580-873-0x0000000007870000-0x00000000078AC000-memory.dmp

Filesize
240KB

Download
memory/4580-874-0x00000000078B0000-0x00000000078FC000-memory.dmp

Filesize
304KB

Download
memory/4580-867-0x0000000007AE0000-0x0000000008084000-memory.dmp

Filesize
5.6MB

Download
memory/4580-866-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5168-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5168-204-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/7108-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7108-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7108-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download