mystic | dd599a6bab1a1dabfa1fca35b3aa571004102301666e21fec5316076b068ab55

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Size 881KB
Sample240524-mb2gdade3y
SHA256 28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
MD5 cc2e5e7ffc0133fc14e8654b0804bcec
SHA1 b3d0700fcb7934976388d2c0c17895e9e3f14bcb
SHA512 c2e0d2c2fc35044475361a2778c589df7e15d621944d9d044f27face34a0d1a2e280cbeb378022431b3cd60b7ca9c2044f54d30a033f94c271f321f876e2ae84
SSDEEP 12288:3MrBy90z7T5xy2dMxJv2TMhvDddoEOHU3M6VndV8TgwlinSVb8YHIES0Vj3sS:yyQ5nyJkMhI503nVIiw4YHIlIj3sS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral4/memory/4632-32-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral4/memory/4632-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral4/memory/4632-33-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/232-43-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	5Yf9Cr0.exe

Executes dropped EXE 8 IoCs

pid	Process
4080	up1PX90.exe
1072	HO9uX28.exe
796	Dk9rY92.exe
1484	1tL11qt9.exe
3136	2ry5231.exe
5052	3pV44sb.exe
2440	4Kn593wz.exe
1688	5Yf9Cr0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	up1PX90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	HO9uX28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Dk9rY92.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 4720	1484	1tL11qt9.exe	91
PID 3136 set thread context of 4632	3136	2ry5231.exe	101
PID 5052 set thread context of 1396	5052	3pV44sb.exe	106
PID 2440 set thread context of 232	2440	4Kn593wz.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5076	1484	WerFault.exe	86
1644	3136	WerFault.exe	98
4944	5052	WerFault.exe	104
4696	2440	WerFault.exe	110

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4720	AppLaunch.exe
4720	AppLaunch.exe
4720	AppLaunch.exe
4152	msedge.exe
4152	msedge.exe
4172	msedge.exe
4172	msedge.exe
1752	msedge.exe
1752	msedge.exe
3816	identity_helper.exe
3816	identity_helper.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 1828 wrote to memory of 1688	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	118
PID 1828 wrote to memory of 1688	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	118

C:\Users\Admin\AppData\Local\Temp\28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
"C:\Users\Admin\AppData\Local\Temp\28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:892
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 588
        6⤵
        Program crash
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3136
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4600
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 152
        6⤵
        Program crash
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5052
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:1396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 148
        5⤵
        Program crash
        
        PID:4944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3144
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 584
      4⤵
      Program crash
      PID:4696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6169.tmp\616A.tmp\616B.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe"
    3⤵
    PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1594496649635451293,17328257977284401661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1594496649635451293,17328257977284401661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
        5⤵
        
        PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
        5⤵
        
        PID:3836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:2592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,557978507730140778,2975940721381785607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        
        PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1484 -ip 1484
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3136 -ip 3136
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2440 -ip 2440
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 ea31d28e32de0c5b3e800bbe0f562ee5d2c1b25894e107642acc66ba59c83463
MD5 37ff31e64fcbabaacbadd249173c77f7
SHA1 a05c348007d4347e5c5e8d242324422995356c6b
SHA512 8bc3186a1d2b2b443de173db0d237d6ffb598e2686e05b846a8520229a570410ed06d00c7818e2dae143e6a0405d4b01e7bef0921540a39748195a639f7fd184
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 66b468cd2dadb636774485c459e992ce34d9983dad97e26a3576bba6b7475210
MD5 6089896c01dd909233656537e905c068
SHA1 0904b1c14acc7169eb01cba7e84a759816ccb1c0
SHA512 7b4bb7fbb97539c1ef02b3fb740786d65591fef74825639937d1cbbaae0ed7f47c1d1dfb4ac072d794d051244bdf4efbebe191704543fb01d34fadc5f0ba2cae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 ab459d0e013a8c08f9c4e5cc7b772dd4e4cacb19ed0dabaa5f87c36b43e7de6c
MD5 0e092b438f0aa902af3c48d6b2554195
SHA1 ae8090f59b9b2c3c06c351cd079bb940530bcfa2
SHA512 59426173d064ae35a4667a60088175a77983a533e782c580f61719eaa82d077eac9f57dcd573c5d52c3a8cff87c5fb60799c2aea35c61fbd59251f1e28a2e85e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3de1bac55d6efcc24cec5d78c05b5587a25de06cfa94a259d7fc090e1c186f5f
MD5 0d828106e4092c61fe1063d8533f78e0
SHA1 a41a44051a01659608c80c238a536593446b7768
SHA512 c9be1c1ed59a5dc2168b454ffafee7ca7792547570a3f523184680e8860a354e48e3c1303ee6674508d964ad3a4c0fd5965cede8a58abd9ef8fbed3381456c81
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1ad3937e046a416a14e6ec7d275fced8cfb9fe44121dd3087addcd8792b77d7a
MD5 ff52a84fd6a9d56ec8d4e33b284e8515
SHA1 8f81c2750eac578ef322ecb49d02050f4716b04a
SHA512 de22518317dea5b3343e676807d183cde6f5c4f4f5a2dc81f7cbb6d5c3fb2f9becd28b10c22c686ecbe1b28e8e0407bcc632766a1e40de68e6cf895a291edaaa
SSDEEP 96:n0k95t1ur0wpMw9WMoiVmde4uN1yuP1+xqu71tYqg/kN+jUWQyV+VD7AiEwb:n0kdMYlw9WMIuNUuP5u7zYqgxjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 15f7dc203a7688bd205a838f192fbed072bd5d4453f810324e5fb37988ca1ebd
MD5 369041dfeed8672353ba39c399b74e73
SHA1 b804f6a849ed4cbc09758ff2dfda2a2ee358eb19
SHA512 0ef56305cabc8be42eefd6f2be5e97cce126b8cf87143fa2cb905f501c6fbb1a56948096b2cffc33af263dfc6c8dc016b64029fcd6b0685be71080f675e2c2ba
SSDEEP 96:n0ky5t12b0wpvWMoiVmdeH/zN+jUWQyV+VDCziEwb:n0kgIoGWMXcjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 f4d2c839dd811c932505e9f9ec47d7b6a1d8b7ace4e9ee1caa3475100cbab343
MD5 0a6d2968fc9304bd12ab27b086b9e52b
SHA1 8e22c80e36114af84c36ca744fa7a236697ba429
SHA512 c4a59ca5f5322eda15a46f120ece0223771a1ccbad00321ecebc12cc20ec6205b89b4276e03a8c07915543e73a2a79a5d3df2fa70457caedc4dedee341814eae
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 3991f5ccfb927eef3bbdd23295207e85988f0f392c7a90b79fac785a485236a2
MD5 e23cbbf7464e3a18e8adb7359fd4dba4
SHA1 bc6fd7ea1d954407480670b0e3279248d88e31a4
SHA512 ff519ef160df8768e00b47320b696beadf85dbbeceb0d094cc8193cba581a75595190a2933b39e4d5c82d23e5247249df7e82d251d7ad48c8b3dea2b677d0a74
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 58264b2290ab868b33ffa6d458dfa287bbd907e8c243f36efc85e357c01606b9
MD5 af64a8b47063f829f927a348693d4427
SHA1 c9fc12a7888014b94a4e222fc1a1f81d1b869214
SHA512 ca220aad66206d0095d6f86587d3ea5b259b81e71a214873b74a0b07d65563d915b533df8374471aece6ac9762a30dc1dc4ae4c52656c8150d3af9c3355dbebb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f118e838960be0234402a289d20626aa3ef0c18f7a2ceaf7b52ef1791fbc18ee
MD5 085ab0d694008ea1a788208ac09f03f8
SHA1 1eb5bbea50cb89d738adb58c7a5303aae4a2fcf8
SHA512 9801b406be99c5809b4f0cad6391ccc92f260808ad71a9dfc850ea6048acec2ebd71921361d579d607f78157207c21a7793e9b02e923ec45c8c68d5fb4e18f18
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d522.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d522.TMP
Size 48B
SHA256 9c07ef6f5a5e9a487a3d51cad297fac7ab9f715a64bceb116efb7110de327c70
MD5 159646199fc5fd879e57982602028cac
SHA1 f9d389bb2b580f5b391df513077b1d543490f65c
SHA512 581c54811b4203b4556fa53a2a0fc30ea8313edf3d9bb544a1784269e06f0775bdb245c46cfb202be768686a4bac253384046ae9229219ffa78bc6df8a22fef1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d0940f340d675698516a106d3d2a1eaee84393771bd7efc65b3b07132540274d
MD5 42383d9784fe2ca7565f5e9e601a2f69
SHA1 ee9b56845e86b04b8abc8d765e3c9990fa643e2b
SHA512 2235e588a5b52bdc4c859fd4a194bd0640855dfa2c548625a2b87a15fbd3354762c3c1024e232d38abab4081d29cc5f111531cd8700a97246bf67fac4b4a62bb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e575575f1ab40b4ff55d1f8f29beed369603311812e84b797dcafd40ca526993
MD5 b28f138c54fd1565591d5a5fc3764f34
SHA1 46e1a55d182626dcde8d88da92891b78cc0155f2
SHA512 fe6b8c293ff97f1c06a6f7abe389bdd5c2193b190501a1813820683bf4e8240b1a1f2b53f6fdfa82f163555c5dc9ad7829f01406b2c3762418a04dd878ab1abf
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ca732c287f3af41be31101e0cf624b97e813519dd504f75e03ad48fff149e855
MD5 d16d4021aae9c7ffb9fdf1fdc4bbc59f
SHA1 ebc8cb07c46386dbefb3e99c7a1495b99325b711
SHA512 98d37d049d533ce677f95b32ec7fd34439d67fd18528f128d281aae1e5165f67a68cfb8a28f2dbce15cd6783da26dacf82a8279882e54d6fa160a45b583d4eaa
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d4a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4a5.TMP
Size 1KB
SHA256 cbd70095067e8632f018b4da33ae6c0a216344d7ff7eae8f3243730757e41365
MD5 e8670cb15c7da15dd08484dc39186c6c
SHA1 9aba47fe98d8b5b9a867a67bad7335d250ee86f0
SHA512 31b76969c343f81f1188fb97c3e79651aa75e455ca6765c3b61cf28226e41ce6c4c9583768af6f5dd967d52a79f457f4baba92fdabc0ebedb0a9221b88543fe1
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7a96614eb9bdeb03698f8f77f335eef786ffd87560ec633c89a56740e9512a70
MD5 081d63e79d89694dd546bfb3f5f75c1d
SHA1 e4f850d74bb7f33224ad50580a66c4e7a0654eef
SHA512 1a62b1a2c47f2fd85a950c76891df88058c9187f3ad692e460675700ed0642f2549dc3841693fa000b20bafca3932f86c26fce8cba437b0fd4b1caf9d2051fd1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRIvQde2RUXoyz3z2OMDCRd:A9iIxuERzA83h09RZxYRmQ5mzaOMWRH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36dc5e0bbad9a80591568dbe6a88e326e0189813e2ecc52d6d0a77b229e2454c
MD5 efbc0cfd4cf93cbe0800882fb1536016
SHA1 5ce6645b0a1a00ff4109a399f3da49dc5eef55c5
SHA512 80c7b818b5e48f96b7b561cff439aa735ff4e45c1f14e5822ee5a082a06c69f588e9b31dc9e366b49fa74789bd09c4437beb7b8857237728dfbac31074ad02aa
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxv3e2RUePyW:S9iIxuERzA83h09RZxY1/MW
MD5 SHA1 SHA512 SSDEEP

Submit Download

da5034fe-f822-4cb7-9292-269f69c12bdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da5034fe-f822-4cb7-9292-269f69c12bdd.tmp
Size 8KB
SHA256 c44f3e2f421058def7384206c746fd10623ee29950d497689e7961478958078c
MD5 402c9f41e9773cfe64dcb577c87e38d4
SHA1 1df3fb7f564dcd462811ea6c51e0fc384ba3aba0
SHA512 9a20033ca5472e8a32743bde0a2f036c8273d7d45f6bf5ffc0b429c105b4d78ec92e5342832e04ff7e61a5dbe60a415eab43d411c2c8d6c4a0ada76074283892
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxvze2RUwPyF:S9iIxuERzA83h09RZxY1jWF
MD5 SHA1 SHA512 SSDEEP

Submit Download

616B.bat

Path C:\Users\Admin\AppData\Local\Temp\6169.tmp\616A.tmp\616B.bat
Size 124B
SHA256 c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668
MD5 dec89e5682445d71376896eac0d62d8b
SHA1 c5ae3197d3c2faf3dea137719c804ab215022ea6
SHA512 b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186
MD5 SHA1 SHA512

Submit Download

5Yf9Cr0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe
Size 87KB
SHA256 1c976143f286cdfd2d706251f1c0b08a48e3bb34f4dcfc25624283bdc84d98f0
MD5 838fd738b03a23429c5e316c0929b9ca
SHA1 4498bfa3de9641c83128e1aea88576818c047510
SHA512 5bef8cee37ca2dc2b75a5e93078efee233ed5c3bc386c66b6e2642437040795aef9d68a119d7f1eb9eb8756759ed637f8aef29ee5af352750c2aa8fb4ade0620
SSDEEP 1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfPxgO:fq6+ouCpk2mpcWJ0r+QNTBfP
MD5 SHA1 SHA512 SSDEEP

Submit Download

up1PX90.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe
Size 742KB
SHA256 14167c209848b4ed0394df308cc54223db091a0a7468f729cb46497d469eca56
MD5 66455fe04a6781dae13fe435ad6ccfe2
SHA1 ce114c5f211747f2907ed85de4b50705d1acc575
SHA512 6d2df4eef507e9ab646167cf57399564ce12dc78b958743055c146e4d72f5a907e22f8fc14e9f944e9eaf9f78f6cdafd33ddc2faa3a91851ffee0b211629f54b
SSDEEP 12288:CMrfy902sr1ZMLEDOdodOHvIF6VFdVTTgwl/n50b8sFIE5A:lyw/ML6oPxFII/64sFISA
MD5 SHA1 SHA512 SSDEEP

Submit Download

4Kn593wz.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe
Size 336KB
SHA256 fbbd49c5b81682757601e4c123afb920492e346e9805b3502ffe4672ffe46ee2
MD5 9d6d2cc80d5a15e49ba12b6161e41ecd
SHA1 1cfc5ece9df90ca26ed7b809af516e417a5b9969
SHA512 450ef07803c0c279908a8cf76ab8f650ec53c53a820dbdc694895398f781d045a82a75fd75ace5d3174984e666342fef56dc0b5afecbc6694ee15a073b9fd951
SSDEEP 6144:/ZEe3bpi5aaYsB34PwLmwyj68UQCZCVoyflI8TJn:/ZEe3QIPwaw1R9lMI8TJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

HO9uX28.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe
Size 508KB
SHA256 576703dd11e586dbe46a35b5312e2dbc477d1d57ec6cfe85f8642319eb057a9c
MD5 2742ca9b8e405cd24c2b823d77feb2e7
SHA1 e0d31ad8678728d1741d3869fafdc9d6ee49dc00
SHA512 8d5b49a0e044af790665e22c5b651bd37809cd1ef68355dc5b6109301955167e24d292be8fa92e326f24ffa4e65be3e323b7adcd6fe4cceb35c29e983192cd2b
SSDEEP 12288:2Mrzy90Y1DWdoWOH3Ap6/FdVTTgwlJ+5Y:xyBbfXbFIIJZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3pV44sb.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe
Size 145KB
SHA256 923dfb377876cfa7c325063e555e312ddc1bc683493ceea61d2200e24bc3cf33
MD5 a5f5917dbb7e2647f560312a5b80d511
SHA1 c9f6fd80f66003275067c9969905bb2a75e33499
SHA512 6bdaf48e97d5350a1615e954ee72ad85c7f6e3499163af4a0f4ac11fb8ee5c86bc1b802896a46a269882fbedceedf85e0901e2bf133151ce813ed76bbf1faa80
SSDEEP 3072:VMunJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQR32anZmnuS830I8TJn:5ZEe3bpi5aaYVWAnuPEI8TJn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dk9rY92.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe
Size 324KB
SHA256 906c2566e35d247a13750588b81390d2368c9e4581ef2d11871c1de4754dd8c5
MD5 ba195c4a52ebe5629efab10395c47610
SHA1 d97be442e8eed9d0b6cfaab18df5fb4aa7d266ec
SHA512 c25cb3d358ab65b3516c4f237b7fd859740be264ca90297180a0ab60ece42d419c35888d274de221714dace64af2d3a6bec8f99c975e0b67e1d2844252f2a3b5
SSDEEP 6144:KFy+bnr+wp0yN90QE2DHJ4ANeS4OrkHBCPfmtjvmmg6at:7Mroy90AzaApOC32m6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

1tL11qt9.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe
Size 129KB
SHA256 b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa
MD5 4ed940ea493451635145489ffbdec386
SHA1 4b5d0ba229b8ac04f753864c1170da0070673e35
SHA512 8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c
SSDEEP 3072:o+ckTAk0lBdvy5tZkvLhu0qZMUQr73bC9SYLyFwEVKKPwJ:QkEdvy54hKnhEVFPwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ry5231.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe
Size 295KB
SHA256 536cfc1067a5d7cfd5ea3caa6a91ca21b79b29dfc12f817d229c8e9c39b6df67
MD5 e608612cecf16ede8fec2fab58aa2204
SHA1 51deba0ae27752ae3220e2817dbe2f96f5efdf56
SHA512 7cf544073da7fc521b89d092a940fbcf956e48369f658653e35ec41b5b72ed4259d09d648744ac502e8da0302b5adc7c4c61c1c28cee0534e75c8e9c6df77cd9
SSDEEP 6144:5ZEe3bpi5aaYOACRlB3nLiYLAlExmKCnVjslJKM0mzkZMV+I8TJn:5ZEe3ZCRlB3nLiyAE0KCnVjsGm/V+I8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-51-0x0000000008BA0000-0x00000000091B8000-memory.dmp

Download

memory/232-54-0x0000000007D10000-0x0000000007D22000-memory.dmp

Download

memory/232-44-0x0000000007FD0000-0x0000000008574000-memory.dmp

Download

memory/232-43-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/232-49-0x0000000002E90000-0x0000000002E9A000-memory.dmp

Download

memory/232-56-0x0000000007DD0000-0x0000000007E1C000-memory.dmp

Download

memory/232-45-0x0000000007B20000-0x0000000007BB2000-memory.dmp

Download

memory/232-55-0x0000000007D90000-0x0000000007DCC000-memory.dmp

Download

memory/232-52-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

Download

memory/1396-39-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4632-35-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4632-32-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4632-33-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4720-28-0x0000000000400000-0x000000000040A000-memory.dmp

Download