Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 21:36

General

  • Target

    248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe

  • Size

    1.8MB

  • MD5

    18cbe55c3b28754916f1cbf4dfc95cf9

  • SHA1

    7ccfb7678c34d6a2bedc040da04e2b5201be453b

  • SHA256

    248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b

  • SHA512

    e1d4a7ab164a7e4176a3e4e915480e5c60efe7680d99f0f0bcbd834a4bec1798b951c49ef5c0cca6bea3c2577b475de3c51b2ef1ae70b525d046eb06591f7110

  • SSDEEP

    49152:Eau0Bnly1l8B6hLa5vMIKHVo5W1v2mS0la98MT:Nfy1Wo+JK19eFE6

Malware Config

Extracted

Family

redline

Botnet

frant

C2

77.91.124.55:19071

Signatures

  • Detect Mystic stealer payload 3 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe
    "C:\Users\Admin\AppData\Local\Temp\248fcc901aff4e4b4c48c91e4d78a939bf681c9a1bc24addc3551b32768f907b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4068
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:212
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4608
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 576
              6⤵
              • Program crash
              PID:4816
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2768
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2444
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 600
              6⤵
              • Program crash
              PID:340
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            5⤵
              PID:3444
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Checks SCSI registry key(s)
              PID:3668
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 592
              5⤵
              • Program crash
              PID:4148
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2468
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 572
            4⤵
            • Program crash
            PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B20A.tmp\B20B.tmp\B20C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
            4⤵
              PID:3296
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffcb1c946f8,0x7ffcb1c94708,0x7ffcb1c94718
                5⤵
                  PID:2284
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,18111602421623233435,14155396086217874123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                  5⤵
                    PID:4524
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,18111602421623233435,14155396086217874123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3336
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                  4⤵
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2020
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcb1c946f8,0x7ffcb1c94708,0x7ffcb1c94718
                    5⤵
                      PID:4196
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                      5⤵
                        PID:4136
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3360
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
                        5⤵
                          PID:1560
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                          5⤵
                            PID:2144
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                            5⤵
                              PID:3560
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
                              5⤵
                                PID:1852
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
                                5⤵
                                  PID:4224
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4228
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                                  5⤵
                                    PID:1000
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                                    5⤵
                                      PID:4452
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                      5⤵
                                        PID:2784
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                                        5⤵
                                          PID:3828
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8960757692036535708,13909861599599444064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3748
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 212 -ip 212
                                  1⤵
                                    PID:4120
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2768 -ip 2768
                                    1⤵
                                      PID:3484
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2720 -ip 2720
                                      1⤵
                                        PID:2924
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2536 -ip 2536
                                        1⤵
                                          PID:1520
                                        • C:\Windows\System32\CompPkgSrv.exe
                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                          1⤵
                                            PID:5104
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:1668

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              111c361619c017b5d09a13a56938bd54

                                              SHA1

                                              e02b363a8ceb95751623f25025a9299a2c931e07

                                              SHA256

                                              d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                              SHA512

                                              fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              983cbc1f706a155d63496ebc4d66515e

                                              SHA1

                                              223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                              SHA256

                                              cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                              SHA512

                                              d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              05c47c09d290e12f06bf360f7e8b8f2f

                                              SHA1

                                              df54cf0efe8def1e66c6a39247b01d62591858dd

                                              SHA256

                                              67f97e0884604f74b6ff575f0ca33208a1812acbbe361881bfd73e77566e1f13

                                              SHA512

                                              b266a50f65cd637fc789c82a834c8ffade83870588cba7750aebf03148199ef30c564cd3009541c3442db043265163012b34dc309ecd3ca655e820e9362b6052

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              c2dc9268e5e0d824e80bdc6fd30a5710

                                              SHA1

                                              6bfdca717c4efe6cfcdef539a1693db6fd7af1f1

                                              SHA256

                                              e859be58c9f9b71962ba8a2292b49f3335dc6c9dd2459e36756655aaa10f4e4a

                                              SHA512

                                              e2a336bfeb851216ee15ca774f669b07e0b91274ed79a94d64d4dc92ebca4f65f3338a07e5ebd956cd191f4fecd3336fc9ea17a4d7f72b79302c269bdb84882f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              832f87c1416df19f5dbf07216a9e60f2

                                              SHA1

                                              cb1e2e3bea1ba79ea3fce3c9b92f6c670c12d82c

                                              SHA256

                                              9a0c0f41d8554e7542310715ffc69eed99dbe7d530ab27f8c6b54efdd88d4ab0

                                              SHA512

                                              92ecb046f400b850a1ce6cda328bada55586e6cbdc606be798f9e389fde5e20114392d9041e14f34bf2fde0db5f110e667c5bf81e75d83356180ed2a6c4e262b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              9952ad1b3114fbb86277934925a97de7

                                              SHA1

                                              027e0d17984cb1ef4ec07d06289d34f6ac1020aa

                                              SHA256

                                              a454eb672181ed7d705cac9f3dfa16e1e8b434c76796308b2f7324c3acf29fbe

                                              SHA512

                                              ba9bd7682a3543240dd3049fb2fc5dd811ac166e4d94139495bcff5289e5d3543bdaab0b24bb83cad65052eeffb57c0a7d1ff616cd8b7819e23e87cbf0bc94cf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              5KB

                                              MD5

                                              1293673f15df21eb178e06d751420c97

                                              SHA1

                                              9853792733979d1127f4720863042dc51bc0e9ed

                                              SHA256

                                              1b515cb25ec2f581c83f01fed216a09eff4a5e3bec046b3cbe3765c0449732af

                                              SHA512

                                              41a0c31186d2ddcb80ed080946c666a39dbf451a30a88b9386ce07e87903dd6c921caaac8576ba0d0b446e41a2553024a413067abd7a7933613a6c1ee2f1a3c9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              872B

                                              MD5

                                              a2b460bb86e4dacf499b1711ba83957d

                                              SHA1

                                              2d1dfeeb8ab2f9e7f4d943843d9f57c66bc3fcd3

                                              SHA256

                                              0e173cfd3304f5bddfe8eaebf0039b49dd76155840c5becfd247f59e61c7756b

                                              SHA512

                                              bc8a54e40a5fb89edb7eaa74133dde54d9333299c487ca134752fb15df7e27cdde51b3f0dcac7cc544f9c433acabbd7f6ccf3abeea28f5ba2812c12e0f5a8b74

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              872B

                                              MD5

                                              c8a26d122e13bf7d0eff94db14a16f42

                                              SHA1

                                              c0f8771b827cae847a520421f4cf1dacf1ccdfd7

                                              SHA256

                                              cbeb6a508a87776bed6e5a634fcce8a4e77be92a0e85672b937b65f5563d9a21

                                              SHA512

                                              287cc17f2babe4684cebafc1c9366104ad870407d710de8da28dd9d9a4357733bee660d6064bf8da72b704e2d2b2a3e866d7d9ddf27dacd08426650f906ba646

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              872B

                                              MD5

                                              0df3122b56d7d6d8faf53017760a66d9

                                              SHA1

                                              b376113f4db74dda0aba63c1fcff966b30181263

                                              SHA256

                                              124b32dec0b21c230357e2332bee593ed76fed3fb9ec64a719e214086627c0b2

                                              SHA512

                                              23cf25fc4a33c55cef4f2b008821b342fa4818940aa41dc02047b944950a215f3ea5d6636cb5f3a48e30fb823860d2dce82c5cb54a5bff10093ce51f0ff10bf6

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              872B

                                              MD5

                                              ff932950fa09eb51a00faf830b05b791

                                              SHA1

                                              fc6f0020567f85ebc767c569bb20e260d571bf2a

                                              SHA256

                                              bab0653768b2ad7ace9f40140046fb9016ae1a568985e4e35b622e147ebce7b1

                                              SHA512

                                              3fc71aef6428304d5fa5a63db8042abe7de170bd98d0da573d6360ccb67166b23a73bfbce4f220f5e654a512f98724cd2f44bf757b83eecd50b6271680a67d62

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              872B

                                              MD5

                                              7e5f126cc93991fbd25a4b387c9bdee1

                                              SHA1

                                              04e09d44d10ed4bc379b505a78cff9d4798e6275

                                              SHA256

                                              348628b0cf1b6d189e665e70a34e5eedef47c6f5debaa251f061d63c25b06ad4

                                              SHA512

                                              bc0c80adf630450637062c1cc05250bc694d72350da9530ec38d22014ade98f1ac451b4df0bf9f962cef5ac46485b630140e2d965e16f2086477ddd742f38fff

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58122b.TMP

                                              Filesize

                                              872B

                                              MD5

                                              d5a358d66178560350e9b549c79eac19

                                              SHA1

                                              1653fff186b28fc346a3235ebfbf1e143722c6b0

                                              SHA256

                                              60359f573a9a8f2edb28fc9d2b110e40ec1775e3550ec1805aefed91bc3d0804

                                              SHA512

                                              d8bd29d456c48ace2450296e904312220e5cfdee9b993be5a4a19bdf3960da3b01bfeaf079c0615e500206575b7cad522cec9f7399b831b009de93fffcbe95ca

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              10KB

                                              MD5

                                              dd40fe2d08a823fc63ec4837043f7497

                                              SHA1

                                              40114d62ecdbc3faf5956ce242e9315e924804e9

                                              SHA256

                                              062927001db94c46ce04e228e7b521eb93f12682c1a1d4968f70b0126a4165aa

                                              SHA512

                                              e435aef8b6ac8d54512a68ba8876b1b48f7fd67e3bc1c6d69aa674bf91a80930263ba0a422c3460e8da9fcaed3a19b67c72da5170270f61b181bbcc1773b97e6

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              8KB

                                              MD5

                                              22068e73fa86dda15073b3f1cb5c032f

                                              SHA1

                                              f2a011790170688c38ca815a5064bd6e060d6411

                                              SHA256

                                              42224da973d49e2f777595a1925c3973fd81a1a65a37fa8ed3674fee60583014

                                              SHA512

                                              12f5b6e362de989ca39e9b5c34a2c8b6850324ad0b10d38f92fbec999430cb19a105af5c68b64cbbbf8875a31c58b1d13fe520beb10e741c011ff40a5e41f4e8

                                            • C:\Users\Admin\AppData\Local\Temp\B20A.tmp\B20B.tmp\B20C.bat

                                              Filesize

                                              90B

                                              MD5

                                              5a115a88ca30a9f57fdbb545490c2043

                                              SHA1

                                              67e90f37fc4c1ada2745052c612818588a5595f4

                                              SHA256

                                              52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d

                                              SHA512

                                              17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uR3lF9.exe

                                              Filesize

                                              100KB

                                              MD5

                                              e0f8b21b36fee4e7738a6b5a1ab83673

                                              SHA1

                                              e305d55d4d47bfa62eae5f8e6f34e5b133a6f40b

                                              SHA256

                                              c567d825d19e24343647ed36c77033fb1f46f420384745a9734618684cb7d384

                                              SHA512

                                              716e6624ff87c859d08e2bbcda1137a2386d30b5b9ef545daf2c6585bc3366561773b9ad6c719a1ad99f1bacb219544ae4556629b355250e2234a7f87d24e238

                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yt8ge85.exe

                                              Filesize

                                              1.7MB

                                              MD5

                                              847ee3021803e4adaefcc00aa8283017

                                              SHA1

                                              87644df0985b5ef9791c72ce79f423350629659e

                                              SHA256

                                              4611614d9c95b0d0e4bf4aa486cc700db6e49dbef7fa2726b20f165e6798a9f7

                                              SHA512

                                              1aaea476c061160439439d2dadc05e451166faa5614ccf8960b592df6933d07c867ab8813c08026b8b2c35b20b03dc0d26641e228fe06cff8c4938367e515b38

                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ii975UD.exe

                                              Filesize

                                              1.8MB

                                              MD5

                                              cfbb3be155b12d0cc69e3d932fbb81eb

                                              SHA1

                                              fb5ed48a80131043c4dd2e4ac69b4b38578f9753

                                              SHA256

                                              fd37c07f519f522eb717a372299525f667439b8b0d1aaffb670a011dbbcd58f2

                                              SHA512

                                              38aadedee5bd57c7f475e96d74abbb0e671bca462c2c700b7a034e2d1513bd8aebc30b7b75bf1e8cd7b7e3a831e69d5dd0ceaee3d18ed296a2cb3d1b051164cc

                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\GY4IC43.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              252043d1805587b0e65a07f885d6719e

                                              SHA1

                                              2210de44be60ba496ea5d4068e715c1308066989

                                              SHA256

                                              66839bc22b9c9f717198cf8faa64146fe95dff51dfbb8c0f61982f2e50e89557

                                              SHA512

                                              dbcdb0b6fe37cf2c733b6683c2e245008400c84b59450f34a794e513955aaf392982e20f2eb2fce696eec2574fe15f699841748a21fce6a1e20a4381fd52f950

                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3FD62NB.exe

                                              Filesize

                                              1.6MB

                                              MD5

                                              7d377f5e1ba6597ff2cfe4f92639367d

                                              SHA1

                                              188ab803c9926ff3448c458030f418099ea03407

                                              SHA256

                                              c705efd2888dfbede96714b58aede50a28b3da45aba83a909cb104ce34dc735e

                                              SHA512

                                              2adad69f3a358ad955b00c8d7826c396feef9d583407d4c7d53ce3e16ed760f148f553f49df5bbcd6c5c68b87bcf7e1472d3c789946b23dab7ae94b4036540e6

                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hE8Zq97.exe

                                              Filesize

                                              725KB

                                              MD5

                                              403a939a04b4384204d35dbc659bf772

                                              SHA1

                                              a5424bc4b18c00fd261d71861fad75502a963397

                                              SHA256

                                              75d5ae4d95b66cb33ccb1b8c39adda5b287ab6c44b11aa42b8f3351024fce1fc

                                              SHA512

                                              860d17990d95694bd7e799b22e6af6fd93a20276439829e945f9aff079b6c708851e8b3e55200b8ef97d41d91608911a414b4a69c26e5593b9b4ca8a134ddbe8

                                            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Zn59od7.exe

                                              Filesize

                                              1.8MB

                                              MD5

                                              ca7a5693b5b0e8b54d6dad6a5b1b86b5

                                              SHA1

                                              49da08ec9be5e002b0d22dd630182c3a905c76c7

                                              SHA256

                                              2d66fdf0417c3d3612015ff191a2010f78fffda1b1f2ed7682181ed7c8fa7c12

                                              SHA512

                                              68ac5c2bb689bbfc903cd2a13fe9ecf998b442690ef41d88f611ce40cb8cca1d795099cd40bc7f5325203e6314baf6a537d8369be78ecb1703f8cfc75cf26158

                                            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2PO9885.exe

                                              Filesize

                                              1.7MB

                                              MD5

                                              144dc3c0a5275a93ff86f00b5c61b9ec

                                              SHA1

                                              784168ab3c4711737656ca13dc4cb59ca267fa45

                                              SHA256

                                              179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787

                                              SHA512

                                              9af6a9870077621eb046d6fed0fac88eba35edd4cd5e60f49c46018ab633d5cc77ddb9a93886178544198099a4e3b20726a32729ec9d1cf89524b4a579afb783

                                            • memory/2444-69-0x0000000000400000-0x0000000000428000-memory.dmp

                                              Filesize

                                              160KB

                                            • memory/2444-67-0x0000000000400000-0x0000000000428000-memory.dmp

                                              Filesize

                                              160KB

                                            • memory/2444-66-0x0000000000400000-0x0000000000428000-memory.dmp

                                              Filesize

                                              160KB

                                            • memory/2468-86-0x00000000078C0000-0x00000000079CA000-memory.dmp

                                              Filesize

                                              1.0MB

                                            • memory/2468-89-0x0000000007750000-0x000000000779C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/2468-77-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2468-78-0x00000000075A0000-0x0000000007632000-memory.dmp

                                              Filesize

                                              584KB

                                            • memory/2468-79-0x0000000002870000-0x000000000287A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/2468-88-0x00000000077B0000-0x00000000077EC000-memory.dmp

                                              Filesize

                                              240KB

                                            • memory/2468-87-0x0000000004FF0000-0x0000000005002000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2468-85-0x0000000008720000-0x0000000008D38000-memory.dmp

                                              Filesize

                                              6.1MB

                                            • memory/3668-73-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                            • memory/4608-38-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-58-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-48-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-46-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-36-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-35-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-41-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-42-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-44-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-54-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-56-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-50-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-60-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-62-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-52-0x00000000029D0000-0x00000000029E6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4608-34-0x00000000029D0000-0x00000000029EC000-memory.dmp

                                              Filesize

                                              112KB

                                            • memory/4608-33-0x0000000005870000-0x0000000005E14000-memory.dmp

                                              Filesize

                                              5.6MB

                                            • memory/4608-32-0x0000000000E80000-0x0000000000E9E000-memory.dmp

                                              Filesize

                                              120KB

                                            • memory/4608-29-0x0000000000400000-0x0000000000432000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4608-31-0x0000000000400000-0x0000000000432000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/4608-28-0x0000000000400000-0x0000000000432000-memory.dmp

                                              Filesize

                                              200KB