mystic | bd5cb5ed04f67f5a6f2f5411e9ad5c457c0c3e3bf3a38e4996624bdfba01d98d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Size 1003KB
Sample240524-jjsbwsab65
SHA256 820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb
MD5 d633ba16a6a77e63044fd70f886471d3
SHA1 41da78358e41bd6d5b513cac508a66d913a35158
SHA512 b2439af134ba4ea592b46473f98a8ea16b2fad4af5acc4dc4e2cd2c977a54e454ef8e976654a0cde4d30883b7284970b7edcbfd3a13f371656b7843af8012aa8
SSDEEP 24576:Wyo4MtnVpaekIsZClGVltDwkbhRqc3LNDj:l/eDusGB7bhbN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline smokeloader taiga backdoor paypal infostealer persistence phishing stealer trojan

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral10/memory/7108-190-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral10/memory/7108-198-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral10/memory/7108-196-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral10/memory/4580-866-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 6 IoCs

pid	Process
4592	KJ9dg91.exe
4588	hZ5tb87.exe
4696	1OH45hT1.exe
6480	2en2870.exe
5168	7QI11ob.exe
6572	8XM435Ts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	KJ9dg91.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	hZ5tb87.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral10/files/0x0008000000023480-20.dat	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6480 set thread context of 7108	6480	2en2870.exe	139
PID 6572 set thread context of 4580	6572	8XM435Ts.exe	169

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7QI11ob.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
2344	msedge.exe
2344	msedge.exe
2036	msedge.exe
2036	msedge.exe
5220	msedge.exe
5220	msedge.exe
5336	msedge.exe
5336	msedge.exe
5988	msedge.exe
5988	msedge.exe
5336	identity_helper.exe
5336	identity_helper.exe
7760	msedge.exe
7760	msedge.exe
7760	msedge.exe
7760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe
4696	1OH45hT1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 2792 wrote to memory of 4592	2792	820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe	83
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4592 wrote to memory of 4588	4592	KJ9dg91.exe	84
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4588 wrote to memory of 4696	4588	hZ5tb87.exe	85
PID 4696 wrote to memory of 2036	4696	1OH45hT1.exe	89
PID 4696 wrote to memory of 2036	4696	1OH45hT1.exe	89
PID 2036 wrote to memory of 1480	2036	msedge.exe	91
PID 2036 wrote to memory of 1480	2036	msedge.exe	91
PID 4696 wrote to memory of 4780	4696	1OH45hT1.exe	92
PID 4696 wrote to memory of 4780	4696	1OH45hT1.exe	92
PID 4780 wrote to memory of 4988	4780	msedge.exe	93
PID 4780 wrote to memory of 4988	4780	msedge.exe	93
PID 4696 wrote to memory of 3952	4696	1OH45hT1.exe	94
PID 4696 wrote to memory of 3952	4696	1OH45hT1.exe	94
PID 3952 wrote to memory of 2936	3952	msedge.exe	95
PID 3952 wrote to memory of 2936	3952	msedge.exe	95
PID 4696 wrote to memory of 1676	4696	1OH45hT1.exe	96
PID 4696 wrote to memory of 1676	4696	1OH45hT1.exe	96
PID 1676 wrote to memory of 3712	1676	msedge.exe	97
PID 1676 wrote to memory of 3712	1676	msedge.exe	97
PID 4696 wrote to memory of 3220	4696	1OH45hT1.exe	98
PID 4696 wrote to memory of 3220	4696	1OH45hT1.exe	98
PID 3220 wrote to memory of 1064	3220	msedge.exe	99
PID 3220 wrote to memory of 1064	3220	msedge.exe	99
PID 4696 wrote to memory of 1764	4696	1OH45hT1.exe	100
PID 4696 wrote to memory of 1764	4696	1OH45hT1.exe	100
PID 1764 wrote to memory of 4468	1764	msedge.exe	101
PID 1764 wrote to memory of 4468	1764	msedge.exe	101
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102
PID 2036 wrote to memory of 2076	2036	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
"C:\Users\Admin\AppData\Local\Temp\820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        6⤵
        
        PID:2076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        6⤵
        
        PID:1476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        6⤵
        
        PID:1800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
        6⤵
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
        6⤵
        
        PID:6052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
        6⤵
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        6⤵
        
        PID:6224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        6⤵
        
        PID:6528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
        6⤵
        
        PID:6704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
        6⤵
        
        PID:6844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
        6⤵
        
        PID:6996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
        6⤵
        
        PID:6600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
        6⤵
        
        PID:7152
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
        6⤵
        
        PID:6856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
        6⤵
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
        6⤵
        
        PID:3284
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8320 /prefetch:8
        6⤵
        
        PID:6080
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8320 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
        6⤵
        
        PID:7380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
        6⤵
        
        PID:7420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8564 /prefetch:1
        6⤵
        
        PID:7428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5844 /prefetch:8
        6⤵
        
        PID:7764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
        6⤵
        
        PID:932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15572219066506905889,11247613400319882521,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 /prefetch:2
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3578562249980140254,7103315123376210775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        6⤵
        
        PID:3116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3578562249980140254,7103315123376210775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,210475167593367205,533988084229298856,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        6⤵
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,210475167593367205,533988084229298856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:3712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11532272958695681981,15707209495789207819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        6⤵
        
        PID:5208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11532272958695681981,15707209495789207819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7805015465882138951,4860238780019544625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:4468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
        5⤵
        
        PID:1376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:2596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
        5⤵
        
        PID:5480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
        5⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        5⤵
        
        PID:6244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd9ea546f8,0x7ffd9ea54708,0x7ffd9ea54718
        6⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:6480
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:7108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:5168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8XM435Ts.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\8XM435Ts.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:7644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 51KB
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487
SSDEEP 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 72KB
SHA256 551caaef94034528e8f8df2fe7b011f424b2b230554a358552b99eb6441e6f47
MD5 549ff996160d606c1d0a7f42fb580629
SHA1 86ddd654b30c3d0841aa03cb2047136fadec9450
SHA512 035c4d3b9c46066b786571ad2d05865a2f8108cb387b3451128ab618f4be77c495d0a4dc6febc565bbc37f45d77f474f6a2c0544240e3f6b097714de6fab43a7
SSDEEP 1536:fbTgO52GiHAhvwyCcFmh4n3dyRjI6H5yDurVXl1mg10dkuV:fbR52Gigh5DwhotyR86IDulTmf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 34KB
SHA256 7d3be672a50529d4ed208efdb7a90fa467eea5adca9bf877e18b167a4511cc24
MD5 64af5e859cd411f58ba7ade44f5a8c26
SHA1 c1ccd85a8209e2bbb58c662f1b621d2cdf7d3565
SHA512 61ec83ff7512bd438f0c7112111af73b1a6eedd1dbf515dfd19c41dc46e58ea4b998f0faee85e7fc75bbc2d142bbf6b337e52e76aec01f4c6725e9d733765240
SSDEEP 768:6xLZjtVGA1aVKX4XO/4Tg9Moo/uPTeDWCnATpcs5zcaBv3P:2LosjX4XO/4M9BcDDOAw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 223KB
SHA256 100b51f83c1ebf8717d0b03fbf1752724877a6c3828b30d24dbd649e1d70de23
MD5 253130eaad29f6b3a8d8e7815c0bd494
SHA1 a4f9c43a0a8bfdea2abb714a89628d9ab53911f1
SHA512 aec0c1d01c6d5c934091913bac199ec1bcfb87297a02237ebb71659dda8040f64217fc21d535efff9ef994085d74c12a7ee6e8ebf711a83f5afa61d765b257d1
SSDEEP 6144:BezPiro7X49CqCXbgSK6JcxekVyZcYxfOr1ys:BRirgp6uMk/ans
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e
Size 206KB
SHA256 374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef
MD5 f998b8f6765b4c57936ada0bb2eb4a5a
SHA1 13fb29dc0968838653b8414a125c124023c001df
SHA512 d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716
SSDEEP 6144:rByHI/jQOq4dOccc0mN2EsmCkJO6hBXUmoq:rEo/jJZd+IZJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067
Size 132KB
SHA256 de760e6ff6b3aa8af41c5938a5f2bb565b6fc0c0fb3097f03689fe2d588c52f8
MD5 3ae8bba7279972ba539bdb75e6ced7f5
SHA1 8c704696343c8ad13358e108ab8b2d0f9021fec2
SHA512 3ca2300a11d965e92bba8dc96ae1b00eca150c530cbfeb9732b8329da47e2f469110306777ed661195ff456855f79e2c4209ccef4a562a71750eb903d0a42c24
SSDEEP 3072:Xzrdu+ESLTWH478dLALqhcgoA/18DFdd9hfdl:XzrdunSLiNi++gj/65ddDll
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 3163b5e1ac4fb852cd7df8917030bc3934ae539cafa46ad75aa4432e55050078
MD5 15e87605d4aaa2653439004b63e093ea
SHA1 48fdfc39a43cee0fd7855db7fc555ba641e63ed6
SHA512 c3e28fe3f2c08c533d78bd24e9a6a137cef5da8aa74447fdb55c4ccbf86b13b27280712d94429dd9db33eeec679750431ca8fef0254a49fad033a540ab7f34f1
SSDEEP 96:49YqHKaeClTlz8yA+44LZCHD+aV8ZhFBWMLPdW52jp6cX7HkAk84H3xZMwntzVi:k5CezTfWMLPyyMcXZa9thi
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7d50bcc38c5e62f92fda5dd5dea579457a02b72f1ba6845ecee1337c5b0df177
MD5 5e6809ba7863bfee50aaa421da9a97f8
SHA1 76007f128e43131b61773d8c27c1a0954e9697e8
SHA512 d65d12da05f3e195f87b5eba3b6ee6d3f8d9ee30f79f3eba931d9e198f7a7f8152ba70c215670e8f77fe4925e63b0c55c736eec83baef7f66247f5faf5179dc7
SSDEEP 96:huM9YqHKaeClTlz8yA+44LZCHD+aV8Zh/BWMLPdW52jp6cX7HkAk84H3xZMwntzU:huo5CezT5WMLPyyMcXZa9thi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 d9cd8cf015d35c8c1485519e4c8314854b1cf9ef531b44ba0cd2362a71d08bf1
MD5 05ab5fe2f5285e7d0ba5c2859ee8739c
SHA1 9447df19cc00a790998c9e3a98c3dc5d282f45c0
SHA512 e36a4785841311b04c3d6420e15ffbb084e1e4fae26ba462752000a6bddcd46816271b089e5a623094e695a5bf27763eaae2cd57afa783ea702f70f2137bf395
SSDEEP 96:lZcMex3JI6f/Udi6xAWKEz7iDFiumvPNGJ/A3z3xNHG4G+qo2GY6GUGlTAoNol:lZcMex3JI6f/Udi6xAWKEz7iDFizvPNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 65c89207045577b891a27c4ecaa03103870ee8061093049e88fa80e8bea6c5cb
MD5 35e4cd83f0fe7cf74aaead294a4abb86
SHA1 0128b24f28793f9405d4688f92a59778ad3f4de3
SHA512 ae3d2e13c10866b29c7459faa21290ff29e751ba8613f724be98fb3c536a5afd9449940a48f53cec649d63dbbc4de0974adda6d410356b652472abb0c999d7bf
SSDEEP 96:lZcMex3JI6f/Udi6xAWKEz7iDFiumvE/A3oNbG+qUG6GUGuNGD3GFGVGrG9ZGoo0:lZcMex3JI6f/Udi6xAWKEz7iDFizvE/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9ce65d0d56304e82d30bb5fdee3286475ca1206b5a702b1a4c3f4084e69a0579
MD5 8e419b6c144009d69427cfd168813e98
SHA1 63bcfa98413b833d45612cb45e2540df4bba8fe7
SHA512 5c8fc554e35188de71848d53478558ce99440bc453e1c15c62eedf99fd6c6607db7e530e6c887eb82b83e4f07cbe084e35899b6bb745c3e78f93dbe325500cd4
SSDEEP 96:nuk5CS19RwpvWMoiVmdeHm0lTqwUWQyV+VDCziEwb:nukZjRGWMXRTqwro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 3da0a4265639ae34a5f74adb0da66bccfedb9f6e364a129b5b36977abad8b54d
MD5 5c2c59e1a5be2427c7f55836ff3f9b2e
SHA1 0f0cb4d67b06fad09a11bf0d02ed0768e5b43f10
SHA512 8918034f53fffba9d4f142dc2bff3df42821e52627481d3e49a691a717807878410985cecf28aefa38a3fe8ac6e8071f6689633cc5929c175a9e3dc498410a40
SSDEEP 192:nuk1/BxU+WM60UYrho/uI6Ou8Mu18uOBurZuWzuQXfK42LZ3PD8qkQ8TqNrg:nuw/FWSoN64fAUZFW8TqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 da92acb5f4da2133070fabdea608a12c189cd24771b1ce9a30e8a538b4092d7c
MD5 4589adb5337493cffb8a3c6145562d84
SHA1 dc2a52eaeee7fb0fe3e73ade28a2817065160693
SHA512 7432eed3b2ca35759beb35b8d7b8a45bc3baed92eb652241e90209c54620b5338d825af6b68e77459c8e8b1a00685f5e01d19e3a254ea36d4fa46f07ddb07173
SSDEEP 192:nukC/BxU+WM60UYrho/uI6Ou8Mu18uOBurZuWzuQXfKl9uLZ3PD8qkQ8TqNrg:nul/FWSoN64fAUZFL8TqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 daaa4a2adb0155311875a899658bfc0ca8a28da32ce437bbfefee6eb7a83a72f
MD5 c357a95ec0791f9f624fb66fbcef4b65
SHA1 618ef02e66946deba17e15375808250e391d7aca
SHA512 f6c1b921670a8ec8d6547e56f18bee653d822a13feb3b9d0eb5f9f9967dad49cd104c6f0a4c8579e91e8f09599158cf10abf681b19409658ec033e87c65539ef
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 447fa90fd0537de6cfa1d2bfa1cbaf91742aa2236397a353c40f42c1f656be0b
MD5 3cce1f16c5e91c45b086e6f7109a55bc
SHA1 bb2cf85b439498ca69cbe1d9548f49d1d99fc5d8
SHA512 a1e515802c0c554317100777c0d88e3413f4ccad76cf09a9fb470bb030180368939460140f1491ed9cbe83be4b9c8e567bb7f692c674913680e6ec2dff131756
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 df4b9e43ed8029f4b7143d779d4352442a77c80a31b024903b1590a9b99516dd
MD5 c7a7b4f1d2d1ccfa25317880dca6d3c9
SHA1 ea086f68686d951ef5a83e6a0d2fe76345e62dfb
SHA512 271d976e8036fb142809a77d0222f45c2d28285861568feda939f24de792c81381c6659ecb1c5221c41982e2dd741465d6c1f179993a08e87d8eaa7203b4dce4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a4ee1a198b4c88746c63ded8426076f84115958f887679f73346f886cd2deb39
MD5 f63e97a9c8659e0b1e02024db7bf36ca
SHA1 03ea6b80a67c49cd64acee06a7b7c296a7c60af2
SHA512 61b0b30ebfc67b7b5e03492b029ae39dfea30c0b96e089e82e86a5422f3bcb3f87834809ac4da7cff437a1f77b7a1bcbb92723e65e17c7d6467a7a8a7c166568
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57f83b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f83b.TMP
Size 48B
SHA256 9c28b0c0ac4ba0469c4ad5837981e6b3438fdec5fe270bc1187d751c529efb66
MD5 365f650a1275d7520564d5dfd5da1c23
SHA1 e70a7b998ac0caee37c442a58bbedd5dfebd9703
SHA512 57841297825ac12dca4d8b79a71fdbcf5dc246552e1ba26b977b176c7cf5a045478349781ce7d49137a2210aa19749e3cd94f846b24e6b39d439a005f9bff0e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 9f9cc34b5cb6f4d46841f173c49308e45b28a921882f827e796caa4b8933d3d3
MD5 44a2d2e58e72c6e54d692d5e41e772db
SHA1 0951066d63041259a8fb68f326e58fb2ad3f5194
SHA512 1a11ed9c22462835fc718b60be25f2a9d43dfdb0fa675948cf6c3926d07e47d909659f3307f8bb40c4e73c2afb4ab8b0dab70f4222613ba9706620fee0da0313
SSDEEP 96:2UNvUqiUNBUqUMUQOUZUwULUuUAiU1fUSyUYhU4sE0UrN7ufUqSKUSnUhUKUYUvE:2UdUZUPUmUVUZUwULUuU3UZUvUmUJE0c
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 5KB
SHA256 ec01c3b461f23700598ce47eb311205e3ff8a161f2a659e717cb107e645ca179
MD5 1603748c5f0a8ae26266720fc39b72f7
SHA1 3e4e75ba7f25a66a3781a78935486f9f3380c37c
SHA512 44e30bb0bf2ab67c7573be90eaa098401e9534f53fe9b2c07b0cb9f56dd42151e2dcc0083d2e56b461862b0107616b88bb5bf0af70c71db7905dacf178d27580
SSDEEP 96:1UwvUqiUNBUqzMUcUZUwULUuUAiU1HBUhLfUSyUYhU4h0URufUqSKUSnUhUKUYU/:1UkUZUPUJUcUZUwULUuU3UfUdUvUmUuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 5KB
SHA256 9bea881b5977782c878d9d0521dc93ef2075acce0ac78b0833e9856bdcb12756
MD5 84ca65f1f06bf1fbbea48c6f70184b7e
SHA1 5df79550843c3baeea18a1ef1c7f53788b1501f5
SHA512 10e1e4ac36140f574ee8b2d31f30eea1ac624bd15eaac5e6895c841e0cc1dd270fca73f0f2164aaf5f6574eba75ba4f6a0192be7b99130202a5f8d6d5bcbac1c
SSDEEP 96:1UwvUqiUNBUqLMUzEUZUXUwQUHUWRUAiU1HBUhLfUSyUYhU4h0URufUq5KUc6nUO:1UkUZUPUFUzEUZUXUwQUHUWRU3UfUdUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe57a400.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a400.TMP
Size 2KB
SHA256 d16c370e28a4f2126e5104e351ceaf914037f0121c5901f9a3191be7bcfcdfdb
MD5 12f19a9f3258ef56d220d0df1fe49413
SHA1 9b1b7868b215c0513fc9c8979f0f1b612a178b76
SHA512 47c184a66bfef2285c9b806cc2c7ff2ab6c63bb37dcd4c46e864a7ac2e5c3795c001fa336429c0f04d086d1386a3396b19cb80bcfcdbdcc873b46a5c2ffcc898
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1b6ecccefd9618a53e35f7dad0945aa3a4209ba7fdab7120c671e9bf9ffb616d
MD5 673aca9b82e7889f4f240e1c212addb1
SHA1 9bdf8b2a36e5b156617a17d19b95c23910811a24
SHA512 5d9eab05972c0ebf1859a20872e786b6cd509c92d86f0a2b8383eae738194fd268dbf99cec91a4d8d0722dd76c4faef7b013fa7ed6df62e51bf83f7a3debd64a
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdre2RUyXzy:F9iIxuERzA83h09RZxYRRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 afe491e01a7fc2c07d8131bc97e73390fc2405054627a1bddd4f52b3e7dccd94
MD5 b6c1e87d834e2d5f2b6a24cbad6e2a2c
SHA1 247b24e7142fc469fc4afbc41eab60ec75d8de66
SHA512 37721d5f802b9e120de5fa186d3affe9c7ef6b07bf93adf66da8c2cd9770cae5b9ff98601a03d6177656c5227bf16712853b0b9ae3c638415d77b2762f06645c
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdOe2RUyXz6:F9iIxuERzA83h09RZxYG16
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ccfc481840f1e0303fd9be0aac9de704783cb10865add67a076f414019d95e3f
MD5 a18fe92ae221b7db2979a0e0da8b66c9
SHA1 f26e5c9b5aee3fb1d2c9ba7086c0cc233244ba81
SHA512 8a066bfb4d1ba2a94ac4234b125cc36eda57da7ed45de3dee7088a443c113f7a54945ef93399727083b6e7ba231ba9715e433b61d8e2eb9647e2abd3a3c1ddba
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdge2RU8Xzb:F9iIxuERzA83h09RZxYsTb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6008a393556bcb2298c63705deae0c885f8c35305ad8196e98ea7f25ddc66ea0
MD5 a0453b958234923be2b0bcab9d5cd5e4
SHA1 71fdbb34e5fef77402ff391ff28eb8571a61c243
SHA512 9d206a734d2c2006b2b5a4bee0b83be63083f458b8bb5b8eb3955186d5b92b002aeafcea2610d38f46c6a402b57e9bf06ddbcfc02fd01c164885aa1bd9f120a2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphGse2RUuKzU3z2OMDCRHqb:A9iIxuERzA83h09RZxYReUaOMWRHqlWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b133cef90c2d881527e310639e8e83b3403e3e088efe819a987d5b0fe5c404ea
MD5 c6cef57301e59b7588060b60e0d6736f
SHA1 256fb5aa8e1043ad44823a15472df290830b7339
SHA512 522c95d9ed554e3b883c694b7e9b902df051ec0060c441fb53ea7c5672948cd65bc31e9887f0230a5dd64472f91dfa1eb797321a1b9c164831e370a80dfcd93e
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdMe2RUVXzw:F9iIxuERzA83h09RZxYkaw
MD5 SHA1 SHA512 SSDEEP

Submit Download

KJ9dg91.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KJ9dg91.exe
Size 782KB
SHA256 40ed5d446543e30361a0f291114ec7f7f96a85901636e529c08eab9bfa5be33b
MD5 d561c554c59dee7d21354c23242ee95c
SHA1 0b5452c70c0b16cf8f7740c946c131575f36daa5
SHA512 e0053496d2330e498484a8a560782ce0e349731d751c8d32e79bd00283e93ef9185a0a0ed3ac91dfe3ba3fbde8bde60f037a18f6a1c7b4cd385704aba54a129e
SSDEEP 12288:NMrqy90yZaOyFQl8ZhHaex4IC5epCPHGDDPLvTMXiYQbDNmS7gNGb4krfJXhVQo:zyLZaO42EZaeuIs6C/GrLYDM1bd4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

7QI11ob.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\7QI11ob.exe
Size 37KB
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
SSDEEP 768:hVrHUoFKUKy9Lxq0qjOwL7Vb8y0/PkbL:hVzUGqJZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

hZ5tb87.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\hZ5tb87.exe
Size 657KB
SHA256 97dbf3cbbcd04069727b3851c47f247a1a485c565aff956ce66805215727efc7
MD5 9641880aad3e0bb627c94584a0a5c467
SHA1 5928e4ceb0e68276195451fccc0af4b55cb2ac20
SHA512 bf227bfdb890bc488ca59191cae6dec74328851f0fc524768d616dddf67cc82166010551d26d1ce12e86b0204ad3d7d834521e46024dd32759206013fa8224c6
SSDEEP 12288:lMrvy9090NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6EqgNG5ukrfw3hPQE:myQiaaewIsgCQGIgYDSG5eeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

1OH45hT1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1OH45hT1.exe
Size 895KB
SHA256 1b71157011fd8e500986f1db88a29e36a1b4374823e151e2ed974b9f36dadb0c
MD5 411c187806134566299f3e66e80ec273
SHA1 59f3c2b53d55a3e5aaeae08b246b56bf9ec4008c
SHA512 e659a92bab316a5e9bdb0759cb4f02efd26d553fda3f5d3325a088c798ac4e4cf52195225b01c63b0925d3d7b6aebc73dbb3b8ca1837495063edfede6f66ceee
SSDEEP 12288:jqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaOT2:jqDEvCTbMWu7rQYlBQcBiT6rprG8a22
MD5 SHA1 SHA512 SSDEEP

Submit Download

2en2870.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2en2870.exe
Size 276KB
SHA256 cc883fa0cc0b0f426d286d1f7b8dc5f28ce6bace2e6f7e99202ac1cfd76055a8
MD5 149ac39a328cd228354ce5fc7859995d
SHA1 696f1f62db6dacd78507d15a11f923890ce026ab
SHA512 ab32ae42ff5f22578476e11e815d78c5d782e86e89aecd4b4f34942cda9a7f65036a355f54820420bc05c811ff286e1cb1addc594c9b502459bfabd9a78deb46
SSDEEP 6144:EKWeIhzyZNGud2cS3s1QCmtq699vTq6VYcrRTsM2HNo7eHKH:EKWewyKbmP6TfVZF7eHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4580-869-0x0000000004BC0000-0x0000000004BCA000-memory.dmp

Download

memory/4580-868-0x0000000007610000-0x00000000076A2000-memory.dmp

Download

memory/4580-870-0x00000000086B0000-0x0000000008CC8000-memory.dmp

Download

memory/4580-871-0x0000000007940000-0x0000000007A4A000-memory.dmp

Download

memory/4580-872-0x0000000007800000-0x0000000007812000-memory.dmp

Download

memory/4580-873-0x0000000007870000-0x00000000078AC000-memory.dmp

Download

memory/4580-874-0x00000000078B0000-0x00000000078FC000-memory.dmp

Download

memory/4580-867-0x0000000007AE0000-0x0000000008084000-memory.dmp

Download

memory/4580-866-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5168-864-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/5168-204-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/7108-196-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/7108-198-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/7108-190-0x0000000000400000-0x0000000000433000-memory.dmp

Download