agenttesla | e36bee5cab09cae33aba2618f5e75fef626843802bca60878c16399e1535d76f

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CounterX2.0.exe
Size

10.7MB
MD5

3d306cd936ed5464528344468af1a2c8
SHA1

c7b961b5c28d91e7e05aab00a4a76d1e0f05aab3
SHA256

e36bee5cab09cae33aba2618f5e75fef626843802bca60878c16399e1535d76f
SHA512

a09cbe428c9c82ae3b39b2fc839d568f3bd90456bf171bec17adae2d23b6c8328f34f8519de6ef6dbd2b800eb9c2975e6445bd36980d5a9f7bc784114b435fd9
SSDEEP

196608:8YpUzYpUHYpUEYpUHYpUuRYVxRYVdtTyKHEyUBkSI:8YpcYpSYpPYpSYpmeTtTyAEy+kS

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/4588-6-0x0000000006DA0000-0x0000000006FB2000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	CounterX2.0.exe

Executes dropped EXE 1 IoCs

pid	Process
5332	CounterX2.0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
35	discord.com
36	discord.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5260	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CounterX2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CounterX2.0.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	CounterX2.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	CounterX2.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	CounterX2.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	CounterX2.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	CounterX2.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	CounterX2.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{D5062BBE-3CF6-4469-A9B0-125F197A2A17}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
5092	msedge.exe
5092	msedge.exe
4532	msedge.exe
4532	msedge.exe
2656	identity_helper.exe
2656	identity_helper.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	CounterX2.0.exe
Token: SeDebugPrivilege	5260	tasklist.exe
Token: SeDebugPrivilege	5332	CounterX2.0.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5092	4588	CounterX2.0.exe	94
PID 4588 wrote to memory of 5092	4588	CounterX2.0.exe	94
PID 5092 wrote to memory of 2144	5092	msedge.exe	95
PID 5092 wrote to memory of 2144	5092	msedge.exe	95
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 992	5092	msedge.exe	96
PID 5092 wrote to memory of 2244	5092	msedge.exe	97
PID 5092 wrote to memory of 2244	5092	msedge.exe	97
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98
PID 5092 wrote to memory of 5040	5092	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\CounterX2.0.exe
"C:\Users\Admin\AppData\Local\Temp\CounterX2.0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://counterx.com.tr/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc197446f8,0x7ffc19744708,0x7ffc19744718
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4792 /prefetch:8
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3964 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:5576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1724 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12844619151563374314,16615784135512416718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/counterx
  2⤵
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc197446f8,0x7ffc19744708,0x7ffc19744718
    3⤵
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5196
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\SysWOW64\find.exe
    find /i "CounterX2.0.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\CounterX2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\CounterX2.0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CounterX2.0.exe.log

Filesize
2KB

MD5
7e2ca081d388bdf0fb309b860949f87f

SHA1
fc77e5e67eb7f73c3b04524366f484ffe3d589d9

SHA256
790282b9b0255cade50f21a513911832dea7e4775d1a9641d5db3eb900eab264

SHA512
3c33b04f4019e32fa81369ce467e1edcba6be0325f91ef6ba22ed48e673c1d8eea2ddbab9286f10b5869d25022e1aa9f5ee6828a5e4cadb952e066c3188a261e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7497325c-e096-43ea-900d-78fd05b59cc5.tmp

Filesize
1KB

MD5
ee358fa84e252790b8e081f8b8d3da62

SHA1
ee12f5b9c91e1455fde81c8ada0906f9aec14da1

SHA256
fb5b4fd309a4004bc1bc657cb7bb2ac5314cca5a6e7bdb7987dac6a548afdcfc

SHA512
d39b35027610d963868aab23794a82fe9f7bc5e44cd58fd7c0d2b185bad576dbe424bd82e201ab168c61122733d7edf161ede9d00233fd45347d5f8da0f71ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
9d4f5a2952231489779528c9fd4b97e4

SHA1
263975f3b619992a4a82d3437f82a055fe51d63a

SHA256
9ded06156b479c856d589366df71c90bf4fa3ca03f84bf654819f049bb4e1a57

SHA512
ba839c9df1911ece9e752a1498bafb5861df5930ac702ce6b36497f14b8f7f97e8f11f9179890bdcdd2d02b8d383cbe23e7f5419989a54687cbbc9f150d17368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
574d88f89f00f169a1bf14a69248147f

SHA1
358b41ed73c15547fe7ac3eb00c789a72286be55

SHA256
0b5a8b56bfca07bc416ccd5913f03856e013cff89a22e21dbe86bb4970672c07

SHA512
6f549cb4b3e046b9550a3af07c2f7fc4c23f75e90dfe5b5ed71c5bcce0f62b8c76757193b1586a663f42543ec06494f3f52972bdd16019eab3ea5b61b848ae2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
f9b2379fb08dbebc87d5abc5c3736f63

SHA1
a2e05f9acc247a8d4d073f37422dbb0037281b75

SHA256
89c71f0c9e56cf2bcd66e46b628c6129b7898d4c881113d774d0696d45a8e041

SHA512
0265d8a16a689e03e4c1d936d3ceb4fb5086a712bc9c98c96b637cd76adc8c01f2861f6fdfd89dc6de477e23271b75872adc472e64cd21e68eb4f35f0f0cf8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d5fedf053e070db4f2819446e402cbc4

SHA1
8cf7fe86b4fba5e40453774aca54725aa89b8e5d

SHA256
1c812a3744b314e7736d94977fa46b989ea753aab8853cdc32715b97cec97846

SHA512
a85b32b538c8ddc4e15d849571f871cee2533a7bda313feaaf7228cf52b6e00e78e327f4386fb09be7b7600623443d7acae0e713571967721cd099682c449297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
63097a845f0aba592c0967a28144cfb7

SHA1
568d1b708f3769a7595a287e51eabcca07e10342

SHA256
a8d5b56a013bb2a42f0afdb219a27941ec02b360847be32773c165261bf230cb

SHA512
298db55657606422e5f5bd9d953867be101cb29f99683b0388753b259cc9c6bc793c915e29fa919c56f744adf8839cf045d56f2e9847424f33f2cf4b89e59ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de6efe5d4237e2c70aa54d1a34dfc170

SHA1
9d7f2e916520b4e065ad4d26c311220751f5e238

SHA256
11c9523c18ceb6cbe061038c2c2d9751696126ebd3c1074f9d3c1813487161bd

SHA512
53e404d2c47a37d4a0b96778ff05d5aad2e22992b4c8871fc95e9f23d3ac0f062581001c2834721a2be41fbad77473e564d1e4612527234e5fef94c461df52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6feae72ab332cde2f282d48e3c223b7

SHA1
82905e26a3fb3a678c41e47ab92181a98ac39f82

SHA256
5c3af511f602f8465f623efce749ca6c3c95e5932c3d76223feb31242c374ac7

SHA512
3eb4304cf35fe20fda1827d367b723b629c5e148c7382f05598597dee0951815d588545561160a5bba178314ceadef4b04cbabe8d719b4c43bbedac2a5b55845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
62a1b3eb625e31a4adc1ca6fac87ffd3

SHA1
3fb081869b5b576afe49c71ef87ef08824c0347d

SHA256
554c2fa307a635cf94d6acba09145b75c51125f448ad3d3740a8222057ab95da

SHA512
34e25ac1798e2dff43785c464230dd620b6b0d6fcf2c817ff5b48abf334e3a93c1edd21b3f9f1bbc31e940fb74a42be276e7afd9904873e6338a9b722952e0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\9a537cee-956c-4be1-8601-1642ce866026\index-dir\the-real-index

Filesize
72B

MD5
afb13e1f25a84231a9a375c223823862

SHA1
3db0458b19fd1f1c325421f9926824d63c63b759

SHA256
358c97c4b9146f465a6f520a835d38d3501d1d9068173622d1a5599dfff62ed8

SHA512
83033f04dc9dcc753bf26951ecd49c8a18c69d4e6ef229b9a8e850e2cd490e55a2cd37a29131cd66fe7a1b2120eda12ec1beebe16388fca6372912974ae4950f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\9a537cee-956c-4be1-8601-1642ce866026\index-dir\the-real-index~RFe586404.TMP

Filesize
48B

MD5
f9e25a691fa16e6a060e02b7d572c554

SHA1
233fb606f3bc79ef4edb28dfe74927e857fcc68e

SHA256
f062fa531c528613fd6f2bb9cfe025db0b8eb0054bee3de3d36c150dbd3b79aa

SHA512
8b38c10579b57a760fe8c476d8c4e6d7e0c21a7cc2afba61180b2f9a2ec8671e5e6d7ccfd16c99a264f66246529866d55c6bf8a77bd4b227840538c46bec27d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\index.txt

Filesize
91B

MD5
354486554041a759d3cfbfa8f37ee065

SHA1
75fbb94b4679b3aea8f6b5794edca2b10626e00e

SHA256
095487c2d01e3af8308da73f6185fda4d9ab8c0569c6c44c5c3dd60c48207f76

SHA512
04b8d6393826a2aec400fab4425c2ea75beb474df04b4ac4443f0b2b61c03c8ce0afdc4a58a041ae7d9f814344b9ebdbd62bfe5d0aa824cd3b1bb27d91b89853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\index.txt

Filesize
26B

MD5
304bfd9b73e383d4c7b36a0a419efb3c

SHA1
6ebb92929daef81ada796a6512d2d9ecdcb47d42

SHA256
d9c3e0c48cc0f2a44aea69a90157133528ec670e35711ca40f88bd55e7cba21d

SHA512
ba04f8937ae7247cab59cbd9145d920a039ef8e26df33465729e54bfa55ad4e11ebc81db97067510a466c14ab368d0d91f531b04ce17aa5002aaf1e5ef65c0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\index.txt

Filesize
91B

MD5
92e2df9563537524a1aa973039711f2d

SHA1
55566f822409809c4c3ae8d61f0bd396034a5ff8

SHA256
561513d2d27a14e6ebf55eb7b603a9ec93896103f0798f59eee91eb52c891f2d

SHA512
1a0e0bd6071db406606c6c328485a9428c2c07050fa9090d643f56bc7015831556871598b58982bb7bc682085dfadc71daed9c682d15138094ed7979cf33d673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\27a198ccd87fcdc5b1c079b184930a254b10675c\index.txt

Filesize
85B

MD5
3b545f38367b5b5ae78c9a0a0fd10d7c

SHA1
ff831d704b9bab6c127827b48d65ce14c4a075fb

SHA256
3533a9ffb39cab5260d25308660ce8aedffc306e32524910241b777f1d4d5a35

SHA512
18a872b536be68407a86e496108835317b20260e2e6360bd594565f8a82fd45db7bf329b0e53fb9ce8c1c858d099b35fd7da3adbbd66f7d11523493930c82016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8334146e02420bc0874c75170b2c4415

SHA1
d01543a1abbf145960a19966a6eec5881cb12bed

SHA256
7efc93d7b27eea3c8dca7d376e3dc6811870096cbf7ddfe8c8c20f8243057539

SHA512
6a76b86b27b93589d55bf5a7b761cfc35520fcd9e6bc3a97fd9eb994e87be2b437c03a7edfe3049185b027b87d241c27b2c1a53179e3afc9a405fe837169af9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5861e2.TMP

Filesize
48B

MD5
c0f550e702f270ee07514ab9c6ececa5

SHA1
a58ed54b46e75cdee81bd88d4a65d8c0bf5596a5

SHA256
38d32d28afe07d95fe3c41395c5199ae0223828552791d9bf3e12473dea0cc60

SHA512
cefe38e12ba42f65cd6ff354ed89558f3003e8d5a9c74d65a831b15b6dff1ac87f7762e01850f77ff5acf7b92465a6274622339305a73b3e46bbc32db2114a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24338555837964d292d9400a90d95679

SHA1
7ce181dcbc0bd4446cf8a660c4ccd03783f19128

SHA256
613c42cac9c93c7075e88b6170856de0b8cc27ba40e10493b1d693c73fcac5eb

SHA512
3e8a4cdb2249d8b14feda479591555eb70dba304dc4c252705e72bc578cf8b17d0905ccc7046b11cad8f9a10ced9c2a09afefcab1d059d7a6651dd8a2cce6da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ba245e4577c15f1d0b078b404923df6

SHA1
ca88e27e97a6118cc9d7931c9ff6b641c61483bc

SHA256
02bfa5eb34d28588d014ee9fcf685dc0a75d672fc8cf48c1bc66ce2b40e7420c

SHA512
f398932d57aa8126da66e6435e5723cb4475d6b7a72509eaaa84c5ed7d2eaf60db9be8650915d0d451654d1a79b2267b44010aae85bb02f7465d50d54f58b8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c4c4c58d851bae4e19d65fa1c70e09c

SHA1
f38d397bc5fa894eae9af48745ee1703fdaafba7

SHA256
6ffad18bbccef139af5d4567e380288bace54ecc874c304db014c86f51b669bd

SHA512
28240e14dea9ed0cc79a9fd895cf3171dbf9d787b4763098b8fb40985dae47251432d93786fedee5b132b87308fef04f4608e7976c41e80833b6aefed417b002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb8325548aa75d1f81b5283f15a0fc32

SHA1
1b579616d68ef86c522cedaf4aaa8886ad7d82e7

SHA256
bf75c1236e6a06989b7336d05e4fbddcfccb85dea6da704c7757078eb4844a64

SHA512
1d777d746c0606f10cabfb833c7422646ef9476aa7272048af7a91605f07e4772adc66bdd8b21f9df63c78e0edfdde4b2a714ed94f4c2c495a4a1f9335b0c0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eb5268cf79a8b8f24e4f4e8833b19295

SHA1
d1c5f3614eddfbba80b60b4814f19c1eb10f0b0d

SHA256
761239681ff76a42ceeda1ac49530bf90e6bad739a88e80363fd54f74ee74359

SHA512
8223a32779af87359e80f6a208057e9b61e815ea568a3c9e8f06cbc4a6c8c42d42cb66e14adee02ae4a405c5a07b5b14732f100c9de3b27737ec2869a590f334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49a6441a6a3cd2d1f6392ee527ba8efd

SHA1
49a54d8f667ba6e910ac455aac9e4cf2a48b3e37

SHA256
bdfd06ef17aef6788bb16e755bbe9d0dc869149a1c3889b7500dfe7e047c7c52

SHA512
8ded72a619018014c703c44df6d4e4c03ad205d3d1b737b37f9a2dfe3a693b6184d08fb5d4782a664af8ed5fbeec6d81c72a5fb2eed7f9496e70f7210a4a83b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589517.TMP

Filesize
538B

MD5
36a8cb7c3d947826f7d751dd4d9b3d4e

SHA1
046f0feec45c72d331337e2dc5c56ac0f6bcc1e9

SHA256
2b87ecf31a0cb17b95b6e6e16ec9a604407a3b2cf832ed5623a334704bc17d5c

SHA512
2d17d5c0e203461fc29e8793c92692359d9932e2a37fb6f0b3936fde0237ebaca37fc6f49742dd40ff9c80e48a7396d714fc717a14f519e218c5c9a138e7b2a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4fa58f1-5616-48de-9088-8e70f52d1030.tmp

Filesize
7KB

MD5
c70b1ee3952f714ce2f0e0fa5e03abdb

SHA1
29ebe18455325568d3e776f27dc9f38a168fcf91

SHA256
526c24beb26cc01a35a2d868a0347b8be182af2d23e47872bce6d6a127cdcd05

SHA512
bf1effba5cca51f6cd5069159b30f1d0242f5d15a66c929d986c69c0c544fda7613127de2a77b6d15e3a56a3d79fd0dfd112360f467084396f4c7fc04c5f032a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bef4077ad16353a0be693090ec97321

SHA1
53dfd1d2c3b63447ba0e01b1bb8c3ea7b40170f1

SHA256
24e150f145f4a447705196f10857a258fde3377f97230a4fa8632bfbe1321aac

SHA512
b46e6fb440b6198ae89741b14d055309315d8f7c0374219758f11be86cba233804bf6bd974044850e744c67c6a5f76f5c145efb9a76b3ee9f88a04eabf75a786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c6be535b950f5b2afa1ac9933bd8769

SHA1
2d29e18830457edefd7bae935410e12e9f0423dc

SHA256
5e42bd193972224fdb950fe2f34c9b6b806b0e931d4f3a5f24a40c28284bb87c

SHA512
d6ceadfb59f76fab880a40b76c8d2c3c28e5a46d3418de9e6aaaa9f2e878ed002396e80d22af41a89b00a4ea795702554e56c4d6629d7e0d4456876c89cf397f

Download Submit
C:\Users\Admin\AppData\Local\Temp\new_version.exe

Filesize
10.7MB

MD5
d74caba3ecfac9bd4e6234c37eab078c

SHA1
a15bcf36908465078776b7e640b7a32efdf67138

SHA256
5c314b4faaccbe4522a0596f916a9513e1f04bf4fd33f9875231812f04015449

SHA512
09c74fcf2931d95aa74c90bd12a2493fc6b70703b46d4e46e910a4654f8f0a23ae8b0d23bb5e925fef4917b505039948aa6436eda0d729779d5f51f25db72aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.bat

Filesize
319B

MD5
3aaaca212f6bfaf413f10bb5c41cc7fe

SHA1
c674269dd1041db0de4738f3261a7d378df54a4a

SHA256
2ef9413ab020fc007916c5cd76fa5fa57710f5f561a5ebeed57c18b2b6137e80

SHA512
07bede9d7b87b4f388bbfef13a9cbec81c9b8cfcf6dc575aef56e6c38e9185d0dbdeed2d32ab5e7d51a35215b1f1b43218d8dee5bc1bcc2a7c09e4deecea6e9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/4588-12-0x000000000C800000-0x000000000C822000-memory.dmp

Filesize
136KB

Download
memory/4588-11-0x000000000A700000-0x000000000A776000-memory.dmp

Filesize
472KB

Download
memory/4588-17-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-16-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-15-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Filesize
4KB

Download
memory/4588-14-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Filesize
4KB

Download
memory/4588-13-0x000000000C850000-0x000000000C86E000-memory.dmp

Filesize
120KB

Download
memory/4588-1-0x0000000000F30000-0x00000000019E8000-memory.dmp

Filesize
10.7MB

Download
memory/4588-242-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-10-0x000000000A5D0000-0x000000000A682000-memory.dmp

Filesize
712KB

Download
memory/4588-9-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-8-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-7-0x0000000006650000-0x0000000006710000-memory.dmp

Filesize
768KB

Download
memory/4588-6-0x0000000006DA0000-0x0000000006FB2000-memory.dmp

Filesize
2.1MB

Download
memory/4588-5-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4588-4-0x00000000062C0000-0x00000000062CA000-memory.dmp

Filesize
40KB

Download
memory/4588-3-0x00000000062E0000-0x0000000006372000-memory.dmp

Filesize
584KB

Download
memory/4588-2-0x00000000067F0000-0x0000000006D94000-memory.dmp

Filesize
5.6MB

Download
memory/5332-247-0x0000000000F90000-0x0000000001A4E000-memory.dmp

Filesize
10.7MB

Download