mystic | dd599a6bab1a1dabfa1fca35b3aa571004102301666e21fec5316076b068ab55

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Size

881KB
MD5

cc2e5e7ffc0133fc14e8654b0804bcec
SHA1

b3d0700fcb7934976388d2c0c17895e9e3f14bcb
SHA256

28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
SHA512

c2e0d2c2fc35044475361a2778c589df7e15d621944d9d044f27face34a0d1a2e280cbeb378022431b3cd60b7ca9c2044f54d30a033f94c271f321f876e2ae84
SSDEEP

12288:3MrBy90z7T5xy2dMxJv2TMhvDddoEOHU3M6VndV8TgwlinSVb8YHIES0Vj3sS:yyQ5nyJkMhI503nVIiw4YHIlIj3sS

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral4/memory/4632-32-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral4/memory/4632-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral4/memory/4632-33-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral4/memory/232-43-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	5Yf9Cr0.exe

Executes dropped EXE 8 IoCs

pid	Process
4080	up1PX90.exe
1072	HO9uX28.exe
796	Dk9rY92.exe
1484	1tL11qt9.exe
3136	2ry5231.exe
5052	3pV44sb.exe
2440	4Kn593wz.exe
1688	5Yf9Cr0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	up1PX90.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	HO9uX28.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Dk9rY92.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1484 set thread context of 4720	1484	1tL11qt9.exe	91
PID 3136 set thread context of 4632	3136	2ry5231.exe	101
PID 5052 set thread context of 1396	5052	3pV44sb.exe	106
PID 2440 set thread context of 232	2440	4Kn593wz.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5076	1484	WerFault.exe	86
1644	3136	WerFault.exe	98
4944	5052	WerFault.exe	104
4696	2440	WerFault.exe	110

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4720	AppLaunch.exe
4720	AppLaunch.exe
4720	AppLaunch.exe
4152	msedge.exe
4152	msedge.exe
4172	msedge.exe
4172	msedge.exe
1752	msedge.exe
1752	msedge.exe
3816	identity_helper.exe
3816	identity_helper.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	AppLaunch.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 1828 wrote to memory of 4080	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	83
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 4080 wrote to memory of 1072	4080	up1PX90.exe	84
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 1072 wrote to memory of 796	1072	HO9uX28.exe	85
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 796 wrote to memory of 1484	796	Dk9rY92.exe	86
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 892	1484	1tL11qt9.exe	90
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 1484 wrote to memory of 4720	1484	1tL11qt9.exe	91
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 796 wrote to memory of 3136	796	Dk9rY92.exe	98
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4600	3136	2ry5231.exe	100
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 3136 wrote to memory of 4632	3136	2ry5231.exe	101
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 1072 wrote to memory of 5052	1072	HO9uX28.exe	104
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 5052 wrote to memory of 1396	5052	3pV44sb.exe	106
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 4080 wrote to memory of 2440	4080	up1PX90.exe	110
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 3144	2440	4Kn593wz.exe	114
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 2440 wrote to memory of 232	2440	4Kn593wz.exe	115
PID 1828 wrote to memory of 1688	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	118
PID 1828 wrote to memory of 1688	1828	28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe	118

C:\Users\Admin\AppData\Local\Temp\28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
"C:\Users\Admin\AppData\Local\Temp\28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:796
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:892
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 588
        6⤵
        Program crash
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3136
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4600
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 152
        6⤵
        Program crash
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5052
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:1396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 148
        5⤵
        Program crash
        
        PID:4944
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3144
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 584
      4⤵
      Program crash
      PID:4696
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6169.tmp\616A.tmp\616B.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe"
    3⤵
    PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1594496649635451293,17328257977284401661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1594496649635451293,17328257977284401661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:1140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
        5⤵
        
        PID:3864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
        5⤵
        
        PID:3836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7855671111606922115,3100381296224567750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff8be3546f8,0x7ff8be354708,0x7ff8be354718
        5⤵
        
        PID:2592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,557978507730140778,2975940721381785607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        5⤵
        
        PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1484 -ip 1484
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3136 -ip 3136
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2440 -ip 2440
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
37ff31e64fcbabaacbadd249173c77f7

SHA1
a05c348007d4347e5c5e8d242324422995356c6b

SHA256
ea31d28e32de0c5b3e800bbe0f562ee5d2c1b25894e107642acc66ba59c83463

SHA512
8bc3186a1d2b2b443de173db0d237d6ffb598e2686e05b846a8520229a570410ed06d00c7818e2dae143e6a0405d4b01e7bef0921540a39748195a639f7fd184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6089896c01dd909233656537e905c068

SHA1
0904b1c14acc7169eb01cba7e84a759816ccb1c0

SHA256
66b468cd2dadb636774485c459e992ce34d9983dad97e26a3576bba6b7475210

SHA512
7b4bb7fbb97539c1ef02b3fb740786d65591fef74825639937d1cbbaae0ed7f47c1d1dfb4ac072d794d051244bdf4efbebe191704543fb01d34fadc5f0ba2cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0e092b438f0aa902af3c48d6b2554195

SHA1
ae8090f59b9b2c3c06c351cd079bb940530bcfa2

SHA256
ab459d0e013a8c08f9c4e5cc7b772dd4e4cacb19ed0dabaa5f87c36b43e7de6c

SHA512
59426173d064ae35a4667a60088175a77983a533e782c580f61719eaa82d077eac9f57dcd573c5d52c3a8cff87c5fb60799c2aea35c61fbd59251f1e28a2e85e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0d828106e4092c61fe1063d8533f78e0

SHA1
a41a44051a01659608c80c238a536593446b7768

SHA256
3de1bac55d6efcc24cec5d78c05b5587a25de06cfa94a259d7fc090e1c186f5f

SHA512
c9be1c1ed59a5dc2168b454ffafee7ca7792547570a3f523184680e8860a354e48e3c1303ee6674508d964ad3a4c0fd5965cede8a58abd9ef8fbed3381456c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ff52a84fd6a9d56ec8d4e33b284e8515

SHA1
8f81c2750eac578ef322ecb49d02050f4716b04a

SHA256
1ad3937e046a416a14e6ec7d275fced8cfb9fe44121dd3087addcd8792b77d7a

SHA512
de22518317dea5b3343e676807d183cde6f5c4f4f5a2dc81f7cbb6d5c3fb2f9becd28b10c22c686ecbe1b28e8e0407bcc632766a1e40de68e6cf895a291edaaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
369041dfeed8672353ba39c399b74e73

SHA1
b804f6a849ed4cbc09758ff2dfda2a2ee358eb19

SHA256
15f7dc203a7688bd205a838f192fbed072bd5d4453f810324e5fb37988ca1ebd

SHA512
0ef56305cabc8be42eefd6f2be5e97cce126b8cf87143fa2cb905f501c6fbb1a56948096b2cffc33af263dfc6c8dc016b64029fcd6b0685be71080f675e2c2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
0a6d2968fc9304bd12ab27b086b9e52b

SHA1
8e22c80e36114af84c36ca744fa7a236697ba429

SHA256
f4d2c839dd811c932505e9f9ec47d7b6a1d8b7ace4e9ee1caa3475100cbab343

SHA512
c4a59ca5f5322eda15a46f120ece0223771a1ccbad00321ecebc12cc20ec6205b89b4276e03a8c07915543e73a2a79a5d3df2fa70457caedc4dedee341814eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
e23cbbf7464e3a18e8adb7359fd4dba4

SHA1
bc6fd7ea1d954407480670b0e3279248d88e31a4

SHA256
3991f5ccfb927eef3bbdd23295207e85988f0f392c7a90b79fac785a485236a2

SHA512
ff519ef160df8768e00b47320b696beadf85dbbeceb0d094cc8193cba581a75595190a2933b39e4d5c82d23e5247249df7e82d251d7ad48c8b3dea2b677d0a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
af64a8b47063f829f927a348693d4427

SHA1
c9fc12a7888014b94a4e222fc1a1f81d1b869214

SHA256
58264b2290ab868b33ffa6d458dfa287bbd907e8c243f36efc85e357c01606b9

SHA512
ca220aad66206d0095d6f86587d3ea5b259b81e71a214873b74a0b07d65563d915b533df8374471aece6ac9762a30dc1dc4ae4c52656c8150d3af9c3355dbebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
085ab0d694008ea1a788208ac09f03f8

SHA1
1eb5bbea50cb89d738adb58c7a5303aae4a2fcf8

SHA256
f118e838960be0234402a289d20626aa3ef0c18f7a2ceaf7b52ef1791fbc18ee

SHA512
9801b406be99c5809b4f0cad6391ccc92f260808ad71a9dfc850ea6048acec2ebd71921361d579d607f78157207c21a7793e9b02e923ec45c8c68d5fb4e18f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d522.TMP

Filesize
48B

MD5
159646199fc5fd879e57982602028cac

SHA1
f9d389bb2b580f5b391df513077b1d543490f65c

SHA256
9c07ef6f5a5e9a487a3d51cad297fac7ab9f715a64bceb116efb7110de327c70

SHA512
581c54811b4203b4556fa53a2a0fc30ea8313edf3d9bb544a1784269e06f0775bdb245c46cfb202be768686a4bac253384046ae9229219ffa78bc6df8a22fef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42383d9784fe2ca7565f5e9e601a2f69

SHA1
ee9b56845e86b04b8abc8d765e3c9990fa643e2b

SHA256
d0940f340d675698516a106d3d2a1eaee84393771bd7efc65b3b07132540274d

SHA512
2235e588a5b52bdc4c859fd4a194bd0640855dfa2c548625a2b87a15fbd3354762c3c1024e232d38abab4081d29cc5f111531cd8700a97246bf67fac4b4a62bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b28f138c54fd1565591d5a5fc3764f34

SHA1
46e1a55d182626dcde8d88da92891b78cc0155f2

SHA256
e575575f1ab40b4ff55d1f8f29beed369603311812e84b797dcafd40ca526993

SHA512
fe6b8c293ff97f1c06a6f7abe389bdd5c2193b190501a1813820683bf4e8240b1a1f2b53f6fdfa82f163555c5dc9ad7829f01406b2c3762418a04dd878ab1abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d16d4021aae9c7ffb9fdf1fdc4bbc59f

SHA1
ebc8cb07c46386dbefb3e99c7a1495b99325b711

SHA256
ca732c287f3af41be31101e0cf624b97e813519dd504f75e03ad48fff149e855

SHA512
98d37d049d533ce677f95b32ec7fd34439d67fd18528f128d281aae1e5165f67a68cfb8a28f2dbce15cd6783da26dacf82a8279882e54d6fa160a45b583d4eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4a5.TMP

Filesize
1KB

MD5
e8670cb15c7da15dd08484dc39186c6c

SHA1
9aba47fe98d8b5b9a867a67bad7335d250ee86f0

SHA256
cbd70095067e8632f018b4da33ae6c0a216344d7ff7eae8f3243730757e41365

SHA512
31b76969c343f81f1188fb97c3e79651aa75e455ca6765c3b61cf28226e41ce6c4c9583768af6f5dd967d52a79f457f4baba92fdabc0ebedb0a9221b88543fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
081d63e79d89694dd546bfb3f5f75c1d

SHA1
e4f850d74bb7f33224ad50580a66c4e7a0654eef

SHA256
7a96614eb9bdeb03698f8f77f335eef786ffd87560ec633c89a56740e9512a70

SHA512
1a62b1a2c47f2fd85a950c76891df88058c9187f3ad692e460675700ed0642f2549dc3841693fa000b20bafca3932f86c26fce8cba437b0fd4b1caf9d2051fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
efbc0cfd4cf93cbe0800882fb1536016

SHA1
5ce6645b0a1a00ff4109a399f3da49dc5eef55c5

SHA256
36dc5e0bbad9a80591568dbe6a88e326e0189813e2ecc52d6d0a77b229e2454c

SHA512
80c7b818b5e48f96b7b561cff439aa735ff4e45c1f14e5822ee5a082a06c69f588e9b31dc9e366b49fa74789bd09c4437beb7b8857237728dfbac31074ad02aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da5034fe-f822-4cb7-9292-269f69c12bdd.tmp

Filesize
8KB

MD5
402c9f41e9773cfe64dcb577c87e38d4

SHA1
1df3fb7f564dcd462811ea6c51e0fc384ba3aba0

SHA256
c44f3e2f421058def7384206c746fd10623ee29950d497689e7961478958078c

SHA512
9a20033ca5472e8a32743bde0a2f036c8273d7d45f6bf5ffc0b429c105b4d78ec92e5342832e04ff7e61a5dbe60a415eab43d411c2c8d6c4a0ada76074283892

Download Submit
C:\Users\Admin\AppData\Local\Temp\6169.tmp\616A.tmp\616B.bat

Filesize
124B

MD5
dec89e5682445d71376896eac0d62d8b

SHA1
c5ae3197d3c2faf3dea137719c804ab215022ea6

SHA256
c3dea90ca98985007f0de66bf0197fdcd2d4a35e365135bf37a18a4895d81668

SHA512
b746b79120d2ff8a9f3327b0bed99c70339155ea831c1eb9f412056fc8de36a0e3005378ba9102bd25ce6cc24fe1171f1a9c8453f33a9bcd6dd59e9ad0f8e186

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Yf9Cr0.exe

Filesize
87KB

MD5
838fd738b03a23429c5e316c0929b9ca

SHA1
4498bfa3de9641c83128e1aea88576818c047510

SHA256
1c976143f286cdfd2d706251f1c0b08a48e3bb34f4dcfc25624283bdc84d98f0

SHA512
5bef8cee37ca2dc2b75a5e93078efee233ed5c3bc386c66b6e2642437040795aef9d68a119d7f1eb9eb8756759ed637f8aef29ee5af352750c2aa8fb4ade0620

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\up1PX90.exe

Filesize
742KB

MD5
66455fe04a6781dae13fe435ad6ccfe2

SHA1
ce114c5f211747f2907ed85de4b50705d1acc575

SHA256
14167c209848b4ed0394df308cc54223db091a0a7468f729cb46497d469eca56

SHA512
6d2df4eef507e9ab646167cf57399564ce12dc78b958743055c146e4d72f5a907e22f8fc14e9f944e9eaf9f78f6cdafd33ddc2faa3a91851ffee0b211629f54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Kn593wz.exe

Filesize
336KB

MD5
9d6d2cc80d5a15e49ba12b6161e41ecd

SHA1
1cfc5ece9df90ca26ed7b809af516e417a5b9969

SHA256
fbbd49c5b81682757601e4c123afb920492e346e9805b3502ffe4672ffe46ee2

SHA512
450ef07803c0c279908a8cf76ab8f650ec53c53a820dbdc694895398f781d045a82a75fd75ace5d3174984e666342fef56dc0b5afecbc6694ee15a073b9fd951

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HO9uX28.exe

Filesize
508KB

MD5
2742ca9b8e405cd24c2b823d77feb2e7

SHA1
e0d31ad8678728d1741d3869fafdc9d6ee49dc00

SHA256
576703dd11e586dbe46a35b5312e2dbc477d1d57ec6cfe85f8642319eb057a9c

SHA512
8d5b49a0e044af790665e22c5b651bd37809cd1ef68355dc5b6109301955167e24d292be8fa92e326f24ffa4e65be3e323b7adcd6fe4cceb35c29e983192cd2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pV44sb.exe

Filesize
145KB

MD5
a5f5917dbb7e2647f560312a5b80d511

SHA1
c9f6fd80f66003275067c9969905bb2a75e33499

SHA256
923dfb377876cfa7c325063e555e312ddc1bc683493ceea61d2200e24bc3cf33

SHA512
6bdaf48e97d5350a1615e954ee72ad85c7f6e3499163af4a0f4ac11fb8ee5c86bc1b802896a46a269882fbedceedf85e0901e2bf133151ce813ed76bbf1faa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Dk9rY92.exe

Filesize
324KB

MD5
ba195c4a52ebe5629efab10395c47610

SHA1
d97be442e8eed9d0b6cfaab18df5fb4aa7d266ec

SHA256
906c2566e35d247a13750588b81390d2368c9e4581ef2d11871c1de4754dd8c5

SHA512
c25cb3d358ab65b3516c4f237b7fd859740be264ca90297180a0ab60ece42d419c35888d274de221714dace64af2d3a6bec8f99c975e0b67e1d2844252f2a3b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1tL11qt9.exe

Filesize
129KB

MD5
4ed940ea493451635145489ffbdec386

SHA1
4b5d0ba229b8ac04f753864c1170da0070673e35

SHA256
b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa

SHA512
8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ry5231.exe

Filesize
295KB

MD5
e608612cecf16ede8fec2fab58aa2204

SHA1
51deba0ae27752ae3220e2817dbe2f96f5efdf56

SHA256
536cfc1067a5d7cfd5ea3caa6a91ca21b79b29dfc12f817d229c8e9c39b6df67

SHA512
7cf544073da7fc521b89d092a940fbcf956e48369f658653e35ec41b5b72ed4259d09d648744ac502e8da0302b5adc7c4c61c1c28cee0534e75c8e9c6df77cd9

Download Submit
memory/232-51-0x0000000008BA0000-0x00000000091B8000-memory.dmp

Filesize
6.1MB

Download
memory/232-54-0x0000000007D10000-0x0000000007D22000-memory.dmp

Filesize
72KB

Download
memory/232-44-0x0000000007FD0000-0x0000000008574000-memory.dmp

Filesize
5.6MB

Download
memory/232-43-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/232-49-0x0000000002E90000-0x0000000002E9A000-memory.dmp

Filesize
40KB

Download
memory/232-56-0x0000000007DD0000-0x0000000007E1C000-memory.dmp

Filesize
304KB

Download
memory/232-45-0x0000000007B20000-0x0000000007BB2000-memory.dmp

Filesize
584KB

Download
memory/232-55-0x0000000007D90000-0x0000000007DCC000-memory.dmp

Filesize
240KB

Download
memory/232-52-0x0000000007EA0000-0x0000000007FAA000-memory.dmp

Filesize
1.0MB

Download
memory/1396-39-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4632-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4632-32-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4632-33-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4720-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download