healer | 106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

max time kernel
1797s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
Size

1.2MB
MD5

5b3b6822964b4151c6200ecd89722a86
SHA1

ce7a11dae532b2ade1c96619bbdc8a8325582049
SHA256

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34
SHA512

2f0d99af35c326cf46810c7421325deb55ae7ca36a8edc2716a3d32d9e6769e0d374581a98912e22fceeb6973e972463ed8b2fa4d4399043c443fa100dfd17b0
SSDEEP

24576:5yY4YriuQJ5X4SuIcmuBLahxwUzN1YyqoVKucvTNLF9:sY4FuIahGxRMoobNLF

Score

10^/10

healer redline ronur discovery dropper evasion infostealer persistence phishing trojan

Malware Config

Extracted

Family

redline

Botnet

ronur

193.233.20.20:4134

Attributes

auth_value
f88f86755a528d4b25f6f3628c460965

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe	healer
behavioral1/memory/4404-35-0x0000000000A30000-0x0000000000A3A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

iwN36Rn.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	iwN36Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	iwN36Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	iwN36Rn.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3520-125-0x00000000024C0000-0x0000000002506000-memory.dmp	family_redline
behavioral1/memory/3520-128-0x0000000004BD0000-0x0000000004C14000-memory.dmp	family_redline
behavioral1/memory/3520-188-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-202-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-200-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-198-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-196-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-194-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-192-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-190-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-186-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-184-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-182-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-180-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-178-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-174-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-173-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-168-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-166-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-165-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-162-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-158-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-156-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-152-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-150-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-148-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-146-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-144-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-140-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-139-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-176-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-170-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-154-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-160-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline
behavioral1/memory/3520-142-0x0000000004BD0000-0x0000000004C0E000-memory.dmp	family_redline

Redline family
redline
A potential corporate email address has been identified in the URL: httpswww.youtube.com@clarkdylancbrd1
phishing
Executes dropped EXE 6 IoCs

Processes:

sbO31En07.exesmS09II74.exeslc39Ad82.exesko86jV13.exeiwN36Rn.exekLG98Ei.exe

pid process

2228 sbO31En07.exe
3940 smS09II74.exe
3252 slc39Ad82.exe
3596 sko86jV13.exe
4404 iwN36Rn.exe
3520 kLG98Ei.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

iwN36Rn.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iwN36Rn.exe

pid	process
2228	sbO31En07.exe
3940	smS09II74.exe
3252	slc39Ad82.exe
3596	sko86jV13.exe
4404	iwN36Rn.exe
3520	kLG98Ei.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	iwN36Rn.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sbO31En07.exesmS09II74.exeslc39Ad82.exesko86jV13.exe106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sbO31En07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	smS09II74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	slc39Ad82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	sko86jV13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sbO31En07.exesmS09II74.exeslc39Ad82.exesko86jV13.exekLG98Ei.exe106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbO31En07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smS09II74.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	slc39Ad82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sko86jV13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kLG98Ei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

msedge.exemsedge.exeiwN36Rn.exeidentity_helper.exemsedge.exe

pid	process
2408	msedge.exe
2408	msedge.exe
1912	msedge.exe
1912	msedge.exe
4404	iwN36Rn.exe
4404	iwN36Rn.exe
4404	iwN36Rn.exe
920	identity_helper.exe
920	identity_helper.exe
6624	msedge.exe
6624	msedge.exe
6624	msedge.exe
6624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

Processes:

msedge.exe

pid	process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

iwN36Rn.exekLG98Ei.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4404	iwN36Rn.exe
Token: SeDebugPrivilege	3520	kLG98Ei.exe
Token: 33	5812	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5812	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exesbO31En07.exesmS09II74.exeslc39Ad82.exesko86jV13.exemsedge.exe

description	pid	process	target process
PID 1008 wrote to memory of 2228	1008	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	sbO31En07.exe
PID 1008 wrote to memory of 2228	1008	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	sbO31En07.exe
PID 1008 wrote to memory of 2228	1008	106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe	sbO31En07.exe
PID 2228 wrote to memory of 3940	2228	sbO31En07.exe	smS09II74.exe
PID 2228 wrote to memory of 3940	2228	sbO31En07.exe	smS09II74.exe
PID 2228 wrote to memory of 3940	2228	sbO31En07.exe	smS09II74.exe
PID 3940 wrote to memory of 3252	3940	smS09II74.exe	slc39Ad82.exe
PID 3940 wrote to memory of 3252	3940	smS09II74.exe	slc39Ad82.exe
PID 3940 wrote to memory of 3252	3940	smS09II74.exe	slc39Ad82.exe
PID 3252 wrote to memory of 3596	3252	slc39Ad82.exe	sko86jV13.exe
PID 3252 wrote to memory of 3596	3252	slc39Ad82.exe	sko86jV13.exe
PID 3252 wrote to memory of 3596	3252	slc39Ad82.exe	sko86jV13.exe
PID 3596 wrote to memory of 4404	3596	sko86jV13.exe	iwN36Rn.exe
PID 3596 wrote to memory of 4404	3596	sko86jV13.exe	iwN36Rn.exe
PID 1912 wrote to memory of 860	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 860	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 3428	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2408	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2408	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe
PID 1912 wrote to memory of 2336	1912	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe
"C:\Users\Admin\AppData\Local\Temp\106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff992a946f8,0x7ff992a94708,0x7ff992a94718
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:6380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:6388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:6984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:6844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1104 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13107124786732453407,17799835124641177727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
  2⤵
  PID:5636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21f9d2ca-47a9-4e95-9aaf-6af6fbaa1b2c.tmp

Filesize
9KB

MD5
241548bd6de94630184af1ca22af3dda

SHA1
b44803209a9c400cc82539aa006925c52ac59326

SHA256
61720c52276ec325792476dce57da7907c78e522b46c56960a0f506b89b7150b

SHA512
9f044304e64b9575a01c8c0d7dc5103f9efbd44fecf38065730fe6f17c6b8e44adb7b309157562f9bc9a060ba18e45afe4b79b0e17969ca9ce324d7cd9f60f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a37cc720c1e57be7e65015832f0544af

SHA1
bf15344938f8c55ca6e3ff9a6579f79d30c8022a

SHA256
d58340423d83284d0bd6b5a9944c2946ad55d8e89094a374c8d711659e0feae4

SHA512
a0bb3b565028f21e973e8f3474004706281577c66805546330ba74dd5e8c310109db6ca5c44f07e31630c7786ad4be11173d9c211e25e3367d720b2466776bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f70212e609d40e8655adb8c8d279dd9d

SHA1
f58920df7ef29d50692011578e3eea92430a7f27

SHA256
5d27e422af532e4f06351565748f7df6e04409cf3689d6fc53eec8cc036818fd

SHA512
f68e873e7360a0385cf4b479210eb05bda4391473a7724894a7a0a326f1758f4a5caa4b3947c0cea28ec5aeb7aa206532bff7c637df6f3e4be4d1dc769d90b8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
dfffa19baf5ef0dd0e425f74d62a1943

SHA1
c614dc15fb025e2e1189d7c87fc536d89b16d688

SHA256
4abcee420e20fb776c83c88767ec8f30082923d79252a8c48fbd82c2500566cd

SHA512
78cb8a0ad5a9beabb73892cbfa64d273e0ebdf66a4470990f6bbc2b4866f1447f88476c9e7256c068292c00f811607413c98225d6373f6d5e11eb7dff2d7f243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2ca6faf3813135d5786f8a6a471bfc2c

SHA1
46ee67a0c796ce4e5fb38d4017b8ae5242072c96

SHA256
063c1e72fcf0df4021fc89e77fc62b61fbd5de45065e0b55458b17032a5553b6

SHA512
429e83be04a6984160e453730d7c30971816622e99d1cea40b0b9c5a8b16f6466c550d5e22f9e80d3010706e9fb6cb5f1babdae6660e36f4b608a428ba66af9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9293889a71cd1eb0b9aef39613021bab

SHA1
b71d884a0c01c9d4cd305918db998a9af9edb92d

SHA256
00ea5061752465f66fdcd32e5c919fc8892658bbbc26a5be5275f364409eedd3

SHA512
1961aaebe4244b1820411ae6ee5b928e622a9d042cd531e399847c85007f5076c494024c2481fc901d214ccd0ae53401d5358b83fbecf610a27b8201adb15f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
832dac2423e7bc8cd0981385c913b8cf

SHA1
8b395a34fb09d9a92bb1b3a6655df44126440d5e

SHA256
bf55603ac38aac0dec410c5603d90bb07dbaf0ecdbecd82795dbbd2c1af5bcf5

SHA512
4224bbdfe2946985892292b752b974bc05a11e59633acf4466293e586fca4e5b7193c50ae3f5e78e6a47b988ad8b89a30696dd4d242bfb70b008cc1447a2638f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
875a5af3fe9c17e8d4cbfc565aaaad47

SHA1
10cc03eb83a0cbecda925e7c44d01237a66d9977

SHA256
0af0d7d30da17288b1c5f1bc2935814440e1eea9aefff29be70cacb5660a7af9

SHA512
c1c26892070ad9564b3ad30714e227a4bc0ec39c5b250277a16d8f8b6eeadc5f7be44635aad85fcac0aceba7d08603c815d5af18f4961cdcbb6349e806d4fa72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5d223bf9d7077883fa66c73ffbd7e8fd

SHA1
47ea2e9a22da3306951b2cf2d814c3c0f06f2818

SHA256
dded786067577854966a9f4d2c85c9faa86149da29df1097d98217a3daab5445

SHA512
3270716d44d658732e1475d3626fb6625476bd44631ecefbc32d62b291b4d21ad84d05300e25592b5671219cbf090042206f29d959f9cfa9a01e439171d4d7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4b340276e907a3b201c8b8f6be29a327

SHA1
72e5dc5c2197423a044c70f3c6eaa7677051c037

SHA256
b9b214f7c3e7e4c7fc980172e5435a98e7367e13b00f335de72e3019734f2ee5

SHA512
47ac706f81830d1c6e471cf11dde48b47f0507b9b95a05d606ffd510930bfa33ba2a43692e12cec0aee2e902e285ce74d2d25d9772dd45b2b4ae658161c9f495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2531f1f508d58dd8b12fd951554bbfb9

SHA1
ba288332bd251dda935f0489ac458cd447a110be

SHA256
7bfce3ba74c8a650ec7504489ffe42359449f7cf9762604ec2702e0be3ebfc56

SHA512
7d131327148d406a6a550cdc3dc7ba9441147076c36b423b837be4acc4e831e15c4153b2fdaa8ec3086a23c203dd815be3cb354b136b51b9d40b42ee6da2c161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b85c48561ac5e8f99b09ea4951485402

SHA1
9fdd3a898444536aee5b9c39fa8f46dc1094dcaa

SHA256
ce6e04cfcb91d93ddccb2226f6445dd6166ff95db6946ae7f96b15aba0c1f0d4

SHA512
277f1dada58da2dfeb96624f0137602a50fe52a06b6501ebf160c4fcfb3c7476241c4c97014487155605f93da8257ac0b0c2847bddbab96a362f5b47a27b5112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c742ad82b80b113e3a464f342466f862

SHA1
178ef753e9649c71a8142c10f83faad77ff75cb5

SHA256
cea7c64c152a56a1272fa3a394b0b6fff1632043659d3d4628cd36c1c68af1dc

SHA512
39d91d6628ab8ad6da619c94dddec7bbdbfaf1be5739370d05004c82c85bcb8d369a7364b8418a881f8f0dcfe2c01f2bb89b5d313008d86c1e2421a7014e9c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9b94f388b023515129f19351ae38081c

SHA1
677627e80ff4564fbae930f58658c1e4430489bd

SHA256
cdb8433c480d58df9cc744c5cff6c3407a26538453f8753397f290c1b98fd7f6

SHA512
bdfb52c601763a52ba54597e4c264141fb7efcbf91f147252c637d96b821713989912cace8f64321e032df85f86c4a88992b05db33e290e1a5f0126505824f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77cebe74539e66ac015ca726e13277e3

SHA1
dafd228f376dd8a6dcb782beed2d90b8b546953b

SHA256
bb0ebda65164efa564de6984c96843c5f8420eaddd534deba2944356d6f5c40d

SHA512
6685c8ed00dffc5cf9b25c6e36ca10055c2463a78322a9f91ca03d5fe3f86fcd045aba4369e771681701ff79cdf28ebb59fa6aac37b82ee1d539313533023810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
55f758a2ef67f79ce3dbab4ce12a8ae3

SHA1
fb06cab591c421ec9650912c4d1da47759e1d908

SHA256
8a6cf3a71b90da504ef91c9f9e3e5cf52efec3b0b72155cd9eeb2e1748eb0c6d

SHA512
4907eb76ba1ae2cf3f571ed1acdede7d11fd7e17b38543b39c10132b226afa44c10eba7b64e49f494391fcaffde5d70312190b70a32dce5453bb22b82168935a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\88d4fff4-a33b-4589-a737-2d4fd473aa32\index-dir\temp-index

Filesize
624B

MD5
af68f2307d9cd811049d99ce3ebb0078

SHA1
2a869513bfac521a83fde7ea4c94da91ba383aa6

SHA256
b47bc47ef7c6ce7fe3e84b9bb082408a53d7139926203e2979ffdc8664cefb65

SHA512
0a528a12b51977f48de96d13771c6dafe0e524162b4e3a97e57e94ebc01c109c88b5366759b114c64dd4ddfa920b6dea6cdd4d415c3cfd962600d878048764f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\88d4fff4-a33b-4589-a737-2d4fd473aa32\index-dir\the-real-index

Filesize
48B

MD5
909b63dfa5cca97b52d08a1ee313ff25

SHA1
015bf6fbfe4c45a4f870563e96fc0e18de581b63

SHA256
4993e50372356132943e443b61f7bed5308b1bdd048ebde1401913b1555caba7

SHA512
d9ba05775fce63b35ce6787d8365783bf599ef089839d6be072dd13fce97ac61c7fe8d98308f3ab2c3651c8f3523a6fb002e6be06dc7028c43ebbdb4a92bfd9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a3d298a0-67d6-45ba-b55c-a10dfc383369\index-dir\the-real-index

Filesize
2KB

MD5
e0219eb5b6d71a2c1886cb39ca773739

SHA1
b434338416a80375e89fa97279e0b6c989ee630b

SHA256
4386d27687f0476adaa03235b7df9ff1af5eadd9121e2bfe8cc807c591de21a0

SHA512
ede26f4745d789b39c475964e9867f5cc9c767eb272d4f587a37082742df97541024f4e12aff7f25393f44a7182b781f41ad055c7572bd8aa82542e2b3aa515e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a3d298a0-67d6-45ba-b55c-a10dfc383369\index-dir\the-real-index~RFe5943c6.TMP

Filesize
48B

MD5
3015b82e6f43b64f425da039c0f601f4

SHA1
9db7ad37c1978b8e214d414b6a577a58e16dc409

SHA256
a67a6c49eaf409517fdc91b775e3f02533bba2ad25dda38b35c23ddabbb02840

SHA512
714e3b4df1b1cdd1a8c0dfcaa45fe07e817d148033561b8ba8c17e9fa1186524cfd4e74636100221406eed19d11c54a60190842a9a78523da4ed6261d49d2bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
45a25c042776b1c933ab131bab8bfa98

SHA1
cabb4feb1e70672678b6f7b60b3c3d72cefc3568

SHA256
2fa18b33d9ee9f861a402b141e180dba894075aad3960fc0bdfdebc54f424d77

SHA512
dffa3094942211c157ba55a53b344c9cdd34dffda0d90c92c997a083cf65d9fd8509401837fd2baf665b316efa28e5a8b7503212f027b652f6a4f00bb31f9b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
ed3182c0c2027a995f5082c32b7e460a

SHA1
a2c957049743b7343d99d48cccf3719a956c4d30

SHA256
8b1d4609ced5b5a9d23f296ca16f43a20ef05a57ee6d549ca74cc4de6efe0920

SHA512
ab0081a04ce628c331c1571e3d58b5ca992563703ebd857597031d1adec689a56289e44fb666436b955d93fbd2c9f1aac79d2192e4933281268e28408eefd5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
882ababacd0c3c3e82762f23170e3b95

SHA1
bcacc50e11733b3d75f1f43da7a21d4fcfa4868b

SHA256
b9262dae5a90fffc60c633c297370e95612b2f88ff4e489f9c8dc06c64b37374

SHA512
97746c81de22c184d0b7f576ea44c3153b53f961f9c4fb0d7b535866aafdd3d4cf54f29a60b33e64a5ffb0ed1b2b75b725e4b2efaae79ef8624b41001e488f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
67366806bd6b81eadf8b83580545f11f

SHA1
992e452adc6871a2b0fd5dff81a232bdb5e313ac

SHA256
0b10ae88232ec9520316d003d0aee2f19e9449cd379c9bd5bc76c0ae62af0464

SHA512
fe685c4abbdd3524b13f7cbc92c2d9ca617d81cb2904995babd183211dbe41e2af2068df08e76dccba2355dd9086361d66505978c4db57f13638b6e7570eb56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
25e2c6421d94aa6967d1d6de5445a7f0

SHA1
fb9721bca28cc182b8e580c93b777d87ed4a8d58

SHA256
b85a1d2e82e720f5be3fbab2e02915e3667e452977d17e2c2b236e51295ac84c

SHA512
84cc7ce44d40d2dcd972f5ffc13d8dbf8046bc723cb78d2333a68304c5d09727d3043ae16e05891b9a43d50631e760a9752a7f70721201e1d251765280660a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
17KB

MD5
a2eae2888415394bbaffe278b285ca79

SHA1
b6749e9868c9672f1915b453ec6c5957512cfdf7

SHA256
3f5a4e8965c931603c64923b9ccf7fd2a418db0e00db01471f12537ca8d4f631

SHA512
14471f6f87ba17fe435ae1ad20486f5ad20d1e353110d02dcf911aaa3e5dd5a75a125d1437cee3c498c4fded1e4acaf0450812ee0458e6df9b77459ebcad9a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Filesize
11KB

MD5
f8827c533e19d3237c29ebc318a028db

SHA1
b0b6f990532fa6e6e1dd78e66f8b4d53f5a902a6

SHA256
c841626058a1b4d5734b639d2c70cb72e0bf5d12cdb735292689a9ec944efdb7

SHA512
682655b71efbc6d9be963dba71b355fdd38771e63cbf0a39008ed78ba134c5e7920cedaa43652e66ad592f0dfce847fdea605c59836a75f7920206b1e74b1e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
163KB

MD5
8764d422787b9208ea8288d683b29815

SHA1
e2a669c1bafeae44de82a48b6a523cd8e8dcaaa9

SHA256
453b2424055638bd908e85b8647934c38a8dae44abe721a051aefc60bd96c1a1

SHA512
e81971259e0004b1833b28d60345b5d1c40f1416c3a9a644c2858abb37d5317edfeca51b0ce012558c54067f3f281571e0a60f3b3d3b9e63e5b000f726fe90d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Filesize
383KB

MD5
d87bf334b08d29861f90f03bce9ea7ad

SHA1
1393b2f39905e972097ce758a0bc2d1a3adbe2ce

SHA256
46e757a1106ee8eb8a8045bc5a468820839fed03c88c46df24e2865418f0218a

SHA512
c0a0adcdbd3bbe96f32f8a7eca8f917334c2bcdb9021bfc5956e09f8d4e024c67182409370f72e2a43135d9f9671f90a023966a0f37c0219f27b5977df9b31b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
45f8106202f605d387acc1351ce04fd9

SHA1
2b2433eda102f623bb15c4a203aae9cc5f9d6ad2

SHA256
4675a068a6aa64b4998f170f383cb7759fc40d655e674f88399c13f12b8995d9

SHA512
d14c7a5a0d7e75151d37e8ba61624316afe5377d5951a1f9d2209ed5b25cc04947a8749f68253bdf97cb62324bfa436aa79d63281efa0229681ecfa5f7a86d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5924a5.TMP

Filesize
48B

MD5
cf839f90a003c3043e7c03ee165e19de

SHA1
8393f967914633be85ade2e071b68957d4efdefa

SHA256
0545a5d9684a2fe3bf1720ce9177d63ff02f7d3bc50754cedc3da2de0efc0710

SHA512
8c1fac0728e65078df1e95bdfbc277647838686040cf854ae67597cd1493ae59470382d666266ccc91d1f866b6907954bcaf3b5571daec2314330b872e959b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
efeef83396650bd109da3958674b4716

SHA1
417247cfeaa8ddafb85209fcf28f1a53c8eaf586

SHA256
12dc93f311991c0b14f65a53f407b2009260c66b925a0fda790a73283a003c20

SHA512
1377eb95951e428b3022679e53a6e6f52b7473c5ad1e2d6000592bd62f0140e8be5f395f39321c671047d485fe62e855d2733b4033eb9042dd92ddf067d67f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
314f96b9294ff6c87b1c6f26b4a05c0b

SHA1
d6d15c2952ef66a7d9274c0924a085f62778db71

SHA256
6061da7ccdd993058dc9a040ded12cab8ec7dd84ca6f403aa658e76c2aac71e2

SHA512
8373320fc4b7ec93d92a394868a64f5632425a0d588379fc3dadf18092919bf0235167cc2ca7e5b54c1172b0166445ba777ff49ef1982222e0b4a1900d2e56c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
03892e7dcd5c51e0421a7238ee3b356a

SHA1
60f04a358fabe04e77161ac803156658494fcd44

SHA256
c91bacaf54e569cf078b932ea8ffbaad580b7cd62e01926c766fdf8863d769ee

SHA512
dac70b799e3c3b9d1fcda9a5f1bac83c115e7bd3ad6c6cd146670ba7677abbf0d8268e5b4d7b189b52e43b6ed29b23a51c7f22649acb609c8b804ba0aa11dff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
1c8133d7b8a062232c09beddbc62a533

SHA1
fd64e588313698fc715939b4a14a5b61042796df

SHA256
4349a966b85e6e1c4b23f66f6242aef10c60c8998aad2fa411aa18b2e82cba71

SHA512
1b9ccc5ee19825abdc183277c7179196d7111471755f82cc49cade949aaa63c5a299a0cff2b36eacc5b0549cf0f3dae02368ce17cecc14050f059b1c82bcf92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fbd6915c59225600c9901fc6cb92799

SHA1
24d71ad97387900fdc5f4fe275a3f6a0242d759d

SHA256
36df1e0da7c78a22196887cbfa45efa9cfe34a4cb44cda18aaf2a421d76d2b60

SHA512
820816e1e6a573a0dca3385d0b271b3b278a435bab3fb8a6e40cec629c31bf65a52053bee34deb086e241838a764f4f93557906b14db6eb378d48dea4add03cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585bc7.TMP

Filesize
371B

MD5
8a7f9668bc778c195af2ccd142b444a5

SHA1
dd1f915431fd6e9df60d9fb0b299b3fb903f5cc6

SHA256
9403fd14520cd18b58d90fd098581b5dc39f7bbf1e31d81944395a39bcd1ce72

SHA512
df1d4b09ca7850113fcca565167a0e328c7925f6b34a4dccc4b26444919fe835acc304be81905c834cb59af8db50559ebbf95818cef13603166206c5fea7fd52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a76a2f59-c621-490d-b3da-dfd32133ea03.tmp

Filesize
7KB

MD5
1c3bf6b723771f0b6db6597c3e6a588c

SHA1
27f863e2f166e59251fbe55b161c6083df3d4124

SHA256
b80e8caee12ace6bbf8675c601202b794e0e4bb14501597c8f683214a9223535

SHA512
dc8cdca5fc6f72b25c7db89dc8b237783d4d8e54c41cf2dd003221b70a6a7e811fdb30e0b684ef819222ed3cdfdee7a464689a83d240bfe1676e1f091893a5a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b741ff38d270364accc09100ccc5fdaa

SHA1
1c100072f2eac97f061bf314cdbf1331cae3acb5

SHA256
433e98ea7d340e24acd9c9c808bf35cf03bda9acf88077a7937c6b9a18c1699d

SHA512
cf03fe71b2142db215539e85732671599bc3b3ae7d44c9fcdd8724b99e0c7e4e2846b1462d299ba078665bd46feb15881ad8d6b7ea2ed34d5c6ebcf6b21bf4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sbO31En07.exe

Filesize
1010KB

MD5
f8d3a0a73fbee1e94dcd0fedf9a31c4e

SHA1
71ef31102516e25e3b3aa347b5c697a85d237b16

SHA256
ad974386b5f8a42a0ff8d77d4f6e1919f2bfbe3f4008320acb1bc327e6f4947c

SHA512
81337186639f964ed048b288be37575ffaa989d9d6c6a91a27db8d6bfe5c4fb42f11d63ab32008e485f921bcb774304a6f96cb4e17778dcc38f1e4b072deca28

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\smS09II74.exe

Filesize
869KB

MD5
5739bc2cafd62977daa950a317be8d14

SHA1
f7f582e1863642c4d5a8341e2005c06c0f3d9e74

SHA256
b3cad94dc96473ea46e9af91de2a2126ee2345d47a2d1a926182db447de2ecc9

SHA512
f55320fdf0383e3c7f8a9841c3444b58f9551d879d89ad1ee44388e9621b4b5f0f7e504915012e3acf24b3aa45a3d0f1e692ddee89a38d3987f95fe97d5bae8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\slc39Ad82.exe

Filesize
651KB

MD5
e12e7b53183d3b1c6cd53ef42aa815f8

SHA1
9dedb739590a02e37c82e54cc8eb3e0ce57248ee

SHA256
63ac9bdbd61a661f5bc96825ad4408df1312b18f455472b63c66f6e5efb05e63

SHA512
5e4a61453476d524cf3b96743e2f5163c01f3ae1d8f05653d9ed3ffd0614b43afa013554e6c0b0294763e80beca5081fc088ad6e595a2af67115a62f4cce410c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sko86jV13.exe

Filesize
383KB

MD5
7c29db2ac66b846cc00ca802838c116b

SHA1
23f9d79f7cf7d5fb41111bf4896645d3989b4f11

SHA256
e4519665ce98d8426aceadad26a6bbe92b455f59f6261a8240dcba5b40e6a51b

SHA512
a46c3d3a3e7ff2ae24cf67eed51367cd5b422cc793911d59de19d2ba0c763c29f569b9876ef41ad74ec3e9977ab280100c09755abdc6908e269bce4a1b761cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iwN36Rn.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kLG98Ei.exe

Filesize
275KB

MD5
ef9dd5707f37f0e2f802b3d7856e7bbc

SHA1
e9cbeca90f2edece7174b0fcffe65f311b5b3689

SHA256
de4cdd6ab46f28034be20c1a3231035ac3dc1aafbb443e0ccaaadd3ccdf0fadf

SHA512
24d042eb4715e4a9ed98609fe264bbd1aded094c2efa410e59a3bd800fc36561242c1433e8573de9581bea6e38b9f269dcd6b2eba20e4548e5cdd893c9334b44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_1912_HCFOWPDPCSRAOKRU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3520-192-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-1049-0x00000000059A0000-0x00000000059B2000-memory.dmp

Filesize
72KB

Download
memory/3520-1050-0x00000000059C0000-0x00000000059FC000-memory.dmp

Filesize
240KB

Download
memory/3520-1051-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Filesize
304KB

Download
memory/3520-1048-0x0000000005870000-0x000000000597A000-memory.dmp

Filesize
1.0MB

Download
memory/3520-1047-0x0000000005250000-0x0000000005868000-memory.dmp

Filesize
6.1MB

Download
memory/3520-142-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-160-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-154-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-170-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-176-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-139-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-140-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-144-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-146-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-148-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-150-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-152-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-156-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-158-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-162-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-165-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-166-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-168-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-173-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-174-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-178-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-180-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-182-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-184-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-186-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-190-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-194-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-196-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-198-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-200-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-202-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-188-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

Filesize
248KB

Download
memory/3520-128-0x0000000004BD0000-0x0000000004C14000-memory.dmp

Filesize
272KB

Download
memory/3520-127-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/3520-125-0x00000000024C0000-0x0000000002506000-memory.dmp

Filesize
280KB

Download
memory/4404-35-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Filesize
40KB

Download