meshagent | hxxps://bazaar[.]abuse[.]ch/download/db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746

Analysis

max time kernel
181s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746

Score

10^/10

meshagent workgroup-09/28/2024 backdoor discovery persistence rat trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

workgroup-09/28/2024

http://94.232.43.185:443/agent.ashx

Attributes

mesh_id
0xEE6F1C863FB7C6EF842533D34533A6378D918D5227918D7E0A0D32295A4DB86E517627EC63E43107A992624908FEFE63
server_id
2BD4C9024778AB65C894FE006870F2822FD2EE492C09B410A85E50D4766668DCFF3ACA2B8AEFE4104B0ACC243B51B701
wss
wss://94.232.43.185:443/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001e590-267.dat	family_meshagent

MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe

Executes dropped EXE 7 IoCs

pid	Process
3680	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
4904	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
436	MeshAgent.exe
2612	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
2140	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
60	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
3880	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\2CB15D830FA5D75323B2BC30A51E19FE20F639C1	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\81A836C7BEDDFDDE2AA7E72E8D8F13EF7BD75314	MeshAgent.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\30EF96F31EDDD84A79B49CC361D601D1ACB4FDC2	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\2CB15D830FA5D75323B2BC30A51E19FE20F639C1	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752563531100098"	MeshAgent.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
1344	msedge.exe
1344	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
3016	msedge.exe
3016	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2032	7zG.exe
Token: 35	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeIncreaseQuotaPrivilege	624	wmic.exe
Token: SeSecurityPrivilege	624	wmic.exe
Token: SeTakeOwnershipPrivilege	624	wmic.exe
Token: SeLoadDriverPrivilege	624	wmic.exe
Token: SeSystemProfilePrivilege	624	wmic.exe
Token: SeSystemtimePrivilege	624	wmic.exe
Token: SeProfSingleProcessPrivilege	624	wmic.exe
Token: SeIncBasePriorityPrivilege	624	wmic.exe
Token: SeCreatePagefilePrivilege	624	wmic.exe
Token: SeBackupPrivilege	624	wmic.exe
Token: SeRestorePrivilege	624	wmic.exe
Token: SeShutdownPrivilege	624	wmic.exe
Token: SeDebugPrivilege	624	wmic.exe
Token: SeSystemEnvironmentPrivilege	624	wmic.exe
Token: SeRemoteShutdownPrivilege	624	wmic.exe
Token: SeUndockPrivilege	624	wmic.exe
Token: SeManageVolumePrivilege	624	wmic.exe
Token: 33	624	wmic.exe
Token: 34	624	wmic.exe
Token: 35	624	wmic.exe
Token: 36	624	wmic.exe
Token: SeIncreaseQuotaPrivilege	624	wmic.exe
Token: SeSecurityPrivilege	624	wmic.exe
Token: SeTakeOwnershipPrivilege	624	wmic.exe
Token: SeLoadDriverPrivilege	624	wmic.exe
Token: SeSystemProfilePrivilege	624	wmic.exe
Token: SeSystemtimePrivilege	624	wmic.exe
Token: SeProfSingleProcessPrivilege	624	wmic.exe
Token: SeIncBasePriorityPrivilege	624	wmic.exe
Token: SeCreatePagefilePrivilege	624	wmic.exe
Token: SeBackupPrivilege	624	wmic.exe
Token: SeRestorePrivilege	624	wmic.exe
Token: SeShutdownPrivilege	624	wmic.exe
Token: SeDebugPrivilege	624	wmic.exe
Token: SeSystemEnvironmentPrivilege	624	wmic.exe
Token: SeRemoteShutdownPrivilege	624	wmic.exe
Token: SeUndockPrivilege	624	wmic.exe
Token: SeManageVolumePrivilege	624	wmic.exe
Token: 33	624	wmic.exe
Token: 34	624	wmic.exe
Token: 35	624	wmic.exe
Token: 36	624	wmic.exe
Token: SeIncreaseQuotaPrivilege	4524	wmic.exe
Token: SeSecurityPrivilege	4524	wmic.exe
Token: SeTakeOwnershipPrivilege	4524	wmic.exe
Token: SeLoadDriverPrivilege	4524	wmic.exe
Token: SeSystemProfilePrivilege	4524	wmic.exe
Token: SeSystemtimePrivilege	4524	wmic.exe
Token: SeProfSingleProcessPrivilege	4524	wmic.exe
Token: SeIncBasePriorityPrivilege	4524	wmic.exe
Token: SeCreatePagefilePrivilege	4524	wmic.exe
Token: SeBackupPrivilege	4524	wmic.exe
Token: SeRestorePrivilege	4524	wmic.exe
Token: SeShutdownPrivilege	4524	wmic.exe
Token: SeDebugPrivilege	4524	wmic.exe
Token: SeSystemEnvironmentPrivilege	4524	wmic.exe
Token: SeRemoteShutdownPrivilege	4524	wmic.exe
Token: SeUndockPrivilege	4524	wmic.exe
Token: SeManageVolumePrivilege	4524	wmic.exe
Token: 33	4524	wmic.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
2032	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 3280	1344	msedge.exe	84
PID 1344 wrote to memory of 3280	1344	msedge.exe	84
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 1196	1344	msedge.exe	85
PID 1344 wrote to memory of 3368	1344	msedge.exe	86
PID 1344 wrote to memory of 3368	1344	msedge.exe	86
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87
PID 1344 wrote to memory of 628	1344	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bazaar.abuse.ch/download/db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa470446f8,0x7ffa47044708,0x7ffa47044718
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1156 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14899722703214444572,18366948241964655157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\" -spe -an -ai#7zMap23747:190:7zEvent31207
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2032

C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
"C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3680
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
  "C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4904

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:436

C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
"C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe"
1⤵
- Executes dropped EXE
PID:2612
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4524

C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
"C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2140
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  PID:1376
- C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
  "C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe" -fulluninstall
  2⤵
  - Executes dropped EXE
  PID:60
- - C:\Windows\system32\cmd.exe
    /C del "C:\Program Files\Mesh Agent\MeshAgent.*" && rmdir "C:\Program Files\Mesh Agent" && rmdir "C:\Program Files"
    3⤵
    PID:228

C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe
"C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe"
1⤵
- Executes dropped EXE
PID:3880
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
35KB

MD5
b1ca33b667804eeec2f3572d25e3e5d9

SHA1
740258a6be0bd47acf1d048a557ce3cec56c71c1

SHA256
eba189ebc4e2c63e250aca6cf0b1cb93be7e13f58ddb49a3ae8409db00df4645

SHA512
89486c444a9500a48ec79a452000a8f2daacad70912f1f49d27b78c3b58153a7c2480adc28e000696b6d5323e86bd6d846c848bdb5064a1a52d11e34dbbcbc8b

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.msh

Filesize
31KB

MD5
3de56c662d2360deb3f6d991f7ed51a8

SHA1
bac7b5df5aff74f5a2279fa940c906425c30ab34

SHA256
adac1bc70d295972b9c0ff4528cb34ef10c3b4f5c795e1ebb6304c51ec35f6d5

SHA512
6ce3a9888166cd683aee80df9a89105a06ba6babf36c3d868b7e32ddc1e3c12e8df7c4b70528d471f9a17a7fbccd4762db60122574bf495a0709f4e113bcf1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
db0dee5b610fe9dcf4ac2dca910ab019

SHA1
e20bde4c8b56ff8e1260d6f27bd2d54872a38baf

SHA256
9208a24b359e999fcd37d7e4ed282e572494cdbce53f08bb04cd20c508c2942d

SHA512
a497d32cc8bf3f2c1bbf74ee06dc3f15f2d3a1a3cd15886271c6e97c8e7117c9ee1335e282bef31ec45b4cc1c9b15a0446428d96c91d04fecc01bf3e2efe5864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f0ece3d91eec658a128275799f24a720

SHA1
a00ac6b90ddbbb18ca853226c98054da18c10bf6

SHA256
ecc6165879e184ddbc677584fe3915b0b6982ae86113a9cbde5c374f5c7ddb98

SHA512
b2554969984736cad406375e5a41faf54a20f3fb2a57a2f8587574f833b3131ba522309acbb105ac69c6f9ba16c6baf6d24a4c3eecdb6beec2ed4731557f1b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
97e8080eb1baf50ea2d7e80655020f5a

SHA1
efa0273818e08780ed2065db8fd5d5f142e930d2

SHA256
c5449abd2613230b61b563da2d4844595bf7beba2229bcf7178f5bde953a3d6e

SHA512
643045d47707a0f0ebe1a495758f145a25a7287db02eadf8d1ff744a2c391207b80c4f591f5095e5657c437d216fb944dad7bd5a8135d31e32c4cd0a8291ec6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a35f350af2410f673dd9e2f6341888a8

SHA1
0857515a5ce2e3e69dcde58a503664ddffb45981

SHA256
3f8027b9a7d688fe4aa365499fa5efbec3f923a527f4617743f11a7180370ca4

SHA512
b421203efef781e00dea46a93b0092820f2edb5d6ab2d95aea156dcd50baf99d9cec10b5c767250e4453eb1f5ceeb3cf406c1ad1efc620c022b7ab012bf4dfec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b57dc730e0b290f9f05ed2d346c71a98

SHA1
c8bb36f579c7ec4f00360af4b98a64c44f0755c2

SHA256
537bc7268fe7fa9c735594d1f502437a2a63541320945e4b5f757e6721eb6b69

SHA512
6db30e273f2c6454be6ff030c93b50f7396ae2d521358549bbf87f94cf95e3f5e43467154fb035eb03816999aec21108d44d4bbf15ffda7c8561cdd0f91fdb06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a46530aa7a6d726698016d1afd65b868

SHA1
31634bf120f44523881db6f7287eff4c4ccea954

SHA256
b91ad04b774348466982864c75e9c2dc1594c5c1cfdae10f12c6b4ce93bba9b1

SHA512
cf377c38c2b20c2982b4db106dfe05b1fc0516c5799642b797edbf2d512b8db52cc5a00c6f9f62435f654c4abe9612f2af730e3e7a23e7884d8fe6486878cc90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4450091b12dfa33b039b016039972dd

SHA1
2d22e5e66ccd58ec5aca7fc3d0ce3e40cd31c855

SHA256
fc50e81a99a516fc6011fe71e324fd52f488d10a0e33095c57eb95845501b335

SHA512
25cb4060060f0341039d6edfa23f9ce905781796e239ba9167b6c914041501ead51164a58a9216eb2c0f65f9863a10f46e266de68cb2c7bb628eed9bfb7f8d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
920f75f9bf582529b4fb40be32c9417b

SHA1
2b48e0337c7259adf4389f366287c2bc91a881eb

SHA256
e8121afdcad0b43ea68dba4306a37cab120cfa7f5914547a148e4a1abb09ff34

SHA512
bddf342163876d71d4a1ee7830c8507f4a6cf5bfeedf0935be13a50863a4f9a7d5a23474ce39aaad4a6df0dc69bc344543818a39b8c8b6525aff11c8e520550e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ac3bf022256393776d253a38477fd6a4

SHA1
d448ee5da4d7c8b54df2edcd0021ff0afcf7e08c

SHA256
beab78cf653feec54f6c636fec965a0906f4539bb2b17c0979b595ef5c2ac3b7

SHA512
7375e9e5659c3499e74bc2a142a1ef2efff2ba48fbadc9fc16e47b69c0fd59b93f4cdb49d19312e84f74ea3c8fc50552b07daff1a79c89e85f3006e602323e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5910cf.TMP

Filesize
370B

MD5
423eeb8d6a1ac200f34946e47f8b4bd3

SHA1
480014db035d9c7e2823e6a778c5ea3195b83d85

SHA256
823192d5374ac1f9a4fa81a0880397f16fc1fb2091e3675969b3c0e9fca0ccd2

SHA512
6474ba9476def7c4acd58ee727c5c2c6ac4da6de434def68aae27514a0b3e56c2bc17ace9cfcd77b201e77c0a72b5edd3821c66aaadbb8c6ee03827c366043fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e1889eec0a6a82c477a1ee735157954c

SHA1
39ff1e32329f2bfc1728cd06c4b743d330f30aab

SHA256
0c6418dee4a3ae824749b26ddcaf14304c1c46aedac2b82d5d9e0f928d920b75

SHA512
7dad3272cb67a86e38cc2fbd3f719153fc6f75b483504428c76cb9c99baf2a42e8a6ffb859ad2b30f89c08c86c0f56ae06df39a196c13188761c7524dd5fb47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2dd56410ed71960ef2d9d84e27a3bf8f

SHA1
2ef3ff5e860b4913f8047d95623b2509a975f22e

SHA256
6377f80bae51009aaf03c52bae382fc6e3b1731c86cd22df5cbfef81b5401aa8

SHA512
1cb4f9762b694ff79a6d823417ff6325b0551e9be4048aa1a00308140f8b2b3f75b7d5f0d47bd32e39de58eb54b10617b5eadb674727d45e9bc371801c651501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
154a314e0639cd77cd4d46bc1cc289a7

SHA1
30408bf9fdb8a7fb8218b65fb7d20636db77788c

SHA256
2b4b71396b590f5b9d71dba0671587bc16403f14445ada4f6be521fb0494b930

SHA512
5363a8e7f1b167b73ad6c1a442c874305fc46033aedd088b2910dca108655ece8683c52b683ff2d4877f5fd2f8106a827f32db58fab31df4fada6da6de410e2d

Download Submit
C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.zip

Filesize
1.7MB

MD5
43037310526bb2e72c8ca228c1431851

SHA1
8abe5b49915b8a16001a368335cb23369cb513e8

SHA256
f57cf3640dfb6ff62094ec2b1de0751bd5d158eaab2a3712c437699e7e381795

SHA512
94409715ae5806fe1421d8c65fe14e7215b2b6a3100d2391d48b4d7d28ebf57a6b6c9e8f8279972dcf727e7308f4724ec229e97d8bb29f3fbec9fa47b0e38967

Download Submit
C:\Users\Admin\Downloads\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746\db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746.exe

Filesize
3.3MB

MD5
0d6e405856f8687fb1a06645a85bb0f3

SHA1
703fe09716b5e92e984c3645157ae9703ed0227d

SHA256
db8174175cec245f15f117503fd9e178307fb3763ea7e2e47541e80bfc953746

SHA512
e7dd401629387eb0c942699333dcab6918df279728321c3e9cd105d2cd26e82ac88dfe1eca291dababce303e7248dfcca4be52c3a09cb79482cd09251cde0098

Download Submit