xred | 9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2

Analysis

max time kernel
115s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Size

2.0MB
MD5

6f57023af56c6fc3c083bbec7fffa520
SHA1

a19799c5604932b425fa221bad31051f32896cc6
SHA256

9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2
SHA512

0bf3ea3f9b77de66c3dfa5a1417fc7e74c3b91a2b827101b02d034945b7e85ed62e37cec8cf7706b0ff8c6cabae40f58b9f937876c991efab15b4d345a2ac381
SSDEEP

49152:qnsHyjtk2MYC5GDczMmPITYbNbNWo4kSH3OqtwIzt:qnsmtk2aFzFPIT4bNJFY3OqtPt

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
636	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
3012	Synaptics.exe
2364	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5316	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5416	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1172	msedge.exe
1172	msedge.exe
908	msedge.exe
908	msedge.exe
5928	identity_helper.exe
5928	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE
5416	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 636	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	82
PID 3560 wrote to memory of 636	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	82
PID 3560 wrote to memory of 636	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	82
PID 3560 wrote to memory of 3012	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	83
PID 3560 wrote to memory of 3012	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	83
PID 3560 wrote to memory of 3012	3560	9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	83
PID 3012 wrote to memory of 2364	3012	Synaptics.exe	84
PID 3012 wrote to memory of 2364	3012	Synaptics.exe	84
PID 3012 wrote to memory of 2364	3012	Synaptics.exe	84
PID 636 wrote to memory of 908	636	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	85
PID 636 wrote to memory of 908	636	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	85
PID 908 wrote to memory of 4704	908	msedge.exe	86
PID 908 wrote to memory of 4704	908	msedge.exe	86
PID 636 wrote to memory of 1528	636	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	87
PID 636 wrote to memory of 1528	636	._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe	87
PID 1528 wrote to memory of 3844	1528	msedge.exe	88
PID 1528 wrote to memory of 3844	1528	msedge.exe	88
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 2300	908	msedge.exe	89
PID 908 wrote to memory of 1204	908	msedge.exe	90
PID 908 wrote to memory of 1204	908	msedge.exe	90
PID 1528 wrote to memory of 4676	1528	msedge.exe	91
PID 1528 wrote to memory of 4676	1528	msedge.exe	91
PID 1528 wrote to memory of 4676	1528	msedge.exe	91
PID 1528 wrote to memory of 4676	1528	msedge.exe	91
PID 1528 wrote to memory of 4676	1528	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
"C:\Users\Admin\AppData\Local\Temp\9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/watch?v=RfDTdiBq4_o
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd445a46f8,0x7ffd445a4708,0x7ffd445a4718
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17334516644467805382,5213200518913505860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/app/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd445a46f8,0x7ffd445a4708,0x7ffd445a4718
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5185698193688414042,7088722089692019331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5185698193688414042,7088722089692019331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1172
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/watch?v=RfDTdiBq4_o
      4⤵
      PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd445a46f8,0x7ffd445a4708,0x7ffd445a4718
        5⤵
        
        PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/app/
      4⤵
      PID:232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffd445a46f8,0x7ffd445a4708,0x7ffd445a4718
        5⤵
        
        PID:1040
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start cmd /C "color b && title Error && echo Application not setup correctly. Please watch the YouTube video for setup. && timeout /t 5"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "color b && title Error && echo Application not setup correctly. Please watch the YouTube video for setup. && timeout /t 5"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.0MB

MD5
6f57023af56c6fc3c083bbec7fffa520

SHA1
a19799c5604932b425fa221bad31051f32896cc6

SHA256
9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2

SHA512
0bf3ea3f9b77de66c3dfa5a1417fc7e74c3b91a2b827101b02d034945b7e85ed62e37cec8cf7706b0ff8c6cabae40f58b9f937876c991efab15b4d345a2ac381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
49KB

MD5
65da8d6932ad74d3b51694b5a28dd0bb

SHA1
aa6e37cdacda153f499c299299a4dacf50c93765

SHA256
309ec80a404d5ba8c9816e0932bff343c8e205fe36819908682289ed7c7ae482

SHA512
bfce7ba0e18dde7d6f833709e565f704701d7a51b14d7c11b06cdce0b057290a334219c9aa4f7ea098c097eb779a2ceca397a9ad1ede0784348f78c81fd55015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
3288444dd0abf6b893abe605d3c3db49

SHA1
6d897134204ce97259e9e473f9529c172f1d206d

SHA256
c77ac712d8d342c8106e84aa3d29f6a15a8c5af758a7a4c7663ee4e7858e0480

SHA512
7ff6cf43585941e29b37de1eb2df0c035aa26e6096e22d468cdf86f32630e9d63045fef531b8ae65a4981aeb645522143912509b97d5d23952102eab9015eff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
f9f63d2ae5d0ad8c6d4816ed1d485a13

SHA1
70e374df5e247eea3c977d4773209065dbd7a949

SHA256
ee172f4e960bc1701c14f97ef5e3007df8b9921dfae9f341fbd3060df24f4710

SHA512
13b928901785c3ff29b64c8a073f9c8e9681e9cdb70dda156fe8dbc26297334c0fee586e30cc519b3f0d1f9e3dec752a872326275d3877544c511d2970b11abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
1e59816d180fd00304bb86b477e9f579

SHA1
2fac057c0b352c656b8e2c7b24524aeb3a6b8b4c

SHA256
72c054be7e85ac72fd1876f832005017fce539336b7aa48bcbf4d7ac67cc6cd9

SHA512
5cc964a8ea6245a2ffadf75a1a457409564e6e78a09f12a8b92f771f6c22c6c0d89b9d3b8621716f1a5ba41e6a3d66a3afa60ecff379ab9f18b50b717e2acf37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7e7d694548eb2bb96a2964a6045c865a

SHA1
96ae4545bd97b8bda9b432618fa4495775a43881

SHA256
6cfa2a3a64f1b457c2162ca9a466e7618c901ed6afe18fcc105662b684f5275e

SHA512
961422eb5ec7cebb380a3938311795255eeafa92dc3c667dc9977467f9a45dc371b04281375a6b75c43fb1f8eab93e564805fa1ec98b92e8689b3cbc23c0e499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
272eb5b6b6aa3a35a836419173142e9a

SHA1
32c282156c500487bd7fb486e633dd2b54c56632

SHA256
6ddf6c18390c98b4429f1938bc9f5a98a3931d04a26f27e88843f39234b012a5

SHA512
cc2ea146ffb8cde547189f5cb2cc657598b55f2ea3f344e4b92c15600f4afb4a69bf55e64b32021f5e8946f06d499bd7f08ad16ec066ec65f2a4e5066b805f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f1642ebb1355ef83feaef1151098a2a

SHA1
b2a2478ce0886328ac266043e3ae1624f1e10a54

SHA256
5a6d2bc081c6d8ee7691d288b4b76992ac8fdd7cc3c6020e976b23c6f78da8e4

SHA512
7b812c61d613f47fea261f77b26222d84b27e7622caddea4e29a6e53ee21ec75f458e98678a0fb7ae6531486a27b778b5632b103a02cf16b55f89d8d47e85199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9a857f428ea3ef6535dbff8e9f6be16

SHA1
b80c3e338c3f14924ce313657f92003dbd075329

SHA256
78151865d5dbd739eb7316a325d88436ac68ec9671e1cf7f7af2335d6c8cc12d

SHA512
98cf3da5f1907dbce6596bb3147e3f46e7a4cf332a58fb4345304510ab29e5a1ae6485327867956acfe41a18ae2eb51aba4306e0c94f1b5bbf78eac8c17159de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
27d8ff5618a43be346c468d105a009d1

SHA1
1fc48a0702ff1c35536d903d27a7cbbd12c6b688

SHA256
70f54ada2c72079109a2c44039f84c407d7b7f0e56427d22bef7c434b80f2051

SHA512
6e674091b1cae1aa46a553cd8a7af7a0d44fdfe44a002629f054786ad52dcda14ac8504145a84f0fd05880cfabdb194aff9094599daf683777abe6347d31b4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
0e373b48048663f3c5f480762df8c14b

SHA1
4eae95be45a4e65fe9ab4f193fd917714d083314

SHA256
2a2dca04c16c880b88807288d014a628c38c7eebfdec68dcc7a41bfb759f9b88

SHA512
65f0c27726dace7fc6a682d5792d2f390ff061c59de4f5f932945be551bdee16d56ae88c6e9bed7bf8429b47cc90fe4011c9653fdc9dc9084d3ad88a252e4fbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
9af5a6a72eb94306c754e120e87df1f0

SHA1
3d57e4245df2f64bd8f4bfab96e59a5316593c67

SHA256
51afda896b6e2eeab8f1ca216289214a058c1a444261423b7f768295919df737

SHA512
246f4c5776e9eb5d4ca2282ba2d596a1b532c6374f9963a857c1a3efbc70366122c55186a3e62de6c37bb221a1caa8e7fbda309dfb377b7d42e5b349b2f51fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57f8b8.TMP

Filesize
89B

MD5
221e6b29ff45826649cb48545dec1576

SHA1
e64e27d9a6d3eca9ecf557a524fee94fe7e09468

SHA256
363949a6021a8c13bcdd16d8fdd0d6b4c937c69b36eea9e54fa0794675b58651

SHA512
c0f50d47b91b1f57106cb27ef80c58574f4df2cff195829b37144f584f2ea21f8da8d48ed6c8739593b1471893bf1d3b6bef7e61f31f5d54c406d65a5f076e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
707b0e04719856e82405d6f61444025a

SHA1
02e4987c8ea4c01cb7059de07db084c57d63afe2

SHA256
a33d3ee8f587fad25ad4c07d2611021ba4d5e42f1ec8387cf0a73cd689f1de2e

SHA512
6ec53d7b78bddc042ddf1177b277e68dae1c353d2f10ca99296f37bfc656ca34f83e65bfe2c6a3c83f80168f889c6c5bfdeb140ab00213dd263951f9ea104208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586d2c.TMP

Filesize
48B

MD5
50bdcac269631a7f5a779c34a02ba4af

SHA1
c2fd072b0cdba6855f83c7da5c74f80ce69f44dd

SHA256
6aafe620780b1143ea66328f647f62abac9c2da47963c043ff8f9eee296d2a50

SHA512
a673721c285487c44e77fb8172bde5837f5750e1a664ccb0e3b8a62d7ec6a1b734689319d5ce42cdb72a6eadfe688fbad73ec3c1c70dac49bbc232fe8ebaf915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
7ccb7d5b3f9b04db36aa34aa820a8a4b

SHA1
e7b80a065e8d10b4b81589d1a6f63e7b2f312830

SHA256
5055aa21aed60c571b2232420e5665959c90c100b1f71d8ec0b0896b77d01859

SHA512
b897ca60fcd1890bcb30f4b303e054700553933e09e7d742c64b8cad08ec2feeb77bc1e0c894531578ff33ed74772a6de8b23e5c0686d1c6908df785fd8d83db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
aa71e4324042d96be72ca3c7db76e382

SHA1
a4d9521227547684e8e7820ded328c476b7a78fd

SHA256
659afa101bd695dc6dbf8d54dcfdba59a1aac854b8056247e6b9711c6e679794

SHA512
a1be218fe6951090b47233576f6c5a8245d3ea92c341b00d9f70d27023d4cea35e9010db294758a760b994708de8fcf67e12c15cb455193b8443cb9ca0624657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
29051ffd2eb3d69ad2cc518d6bc07ef5

SHA1
763ab9c62ebe6cf84c46de7a1649ec46d3aecf9a

SHA256
a7e70c091a8d9b1160616a680859afa7e5fd8ca17a8d1fbe3014cf8e5bd2c35c

SHA512
7f628091dc95a276bfaa2b40bd4d10df95895fdbb770f645c12b734816c1f16390cc433cdc4e6a8d46c259d5a4179c837216f183d18ef45c6eef8ee3d243e683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5820a2.TMP

Filesize
873B

MD5
fc329d2b82daf0f6e642a8b469035e27

SHA1
e4e2eb92613506ef11162ae12b78e631dd4d74a8

SHA256
e636cb603a11e6567e652d511e6ef0c04769f095eb380b652765efd7a6edcfcf

SHA512
a1ed17c71ea1cd2c0c92e864a5114fb22fd762172fcceb6846ac10341d94ad1ee03f7571ae093e7b1167e96ab982e0637124321f163e85cab5fe2aee3170551c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4b660f764648751201dc6def04eea1eb

SHA1
55d499c04ad3cb2401b81a7b1aa4f555876a188c

SHA256
fdc3478d4a6762be97b5d6232501fc1e85f34b764ea63cf74270740b7d403ea1

SHA512
70ca7bb371dc9b793963384e4914ef2f95e42b43b6776fea95ab8d4c0b17b31e461e340aa9f144bbfe5e3c9ed833a19c6a50b0a83e1a84c21ad94dec24de7ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3da4641ad44142cefebad9d760632817

SHA1
ae6ea845a7311a13045ac64c5f733aaa0424d814

SHA256
327b60c561d098de8cadfb5a171d27520ac28c1e339919b1049234e9c65d2503

SHA512
3489355e5a0d0df242e418eac7d3bf45d6aa1ebdaf2bb0acf8b09330aeb60accc6ec569e6c4b9bb5c35061efc08477a487e909075e96679cd2fa3be18a39ce58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
5c49ee6f7e482a4ee6b06e0e319dd2fd

SHA1
ef428e127a7596831409ca7a4d10fed5d15570d6

SHA256
6a4a755795b88d7dc5731f1e5f94eb4c33018720282074f49b45cb24e75ab50c

SHA512
02f96effc307a9b2572dee764508f9bcb2e093c51db9e15f3a1cc269b3e9b07333423a2ca68527892a7941350375290cfba28d3a77abdc6c25393e9ed269b6d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_9eb4b11792b3467349e163d207066fc65e911d77d317456bf58f96cc1913e4f2N.exe

Filesize
1.3MB

MD5
b9773451b024cd03b844bc09cd17a3f4

SHA1
c3b11a40d7e141b1712e89ec6f4d0a7a273f7e6f

SHA256
8a1cda86fda420345e59cf46954aa2ac713a4549d2d2a2f36f27c0f5f01a1a82

SHA512
44923981b897fa080684960375eb5dcf562e86b1de012126ccad8bcd147e0b78eded1dec00faacef8a273355d553829f6e7c1ac101c6ccde8d976426b952312b

Download Submit
C:\Users\Admin\AppData\Local\Temp\87085E00

Filesize
23KB

MD5
1ad3ee2ffe41ceb8d1ef5fc9499c903f

SHA1
e66c121f5dc631ebfc14b2ab565081f6033c3128

SHA256
2a16ba845ea389f4631c1d396fa60f390d6df8e61c6a4e0d48a10fa766dce13b

SHA512
94c1f1ed9427cb438ebe9ddd66f74340c05e68ff683f2010159c6591fdfd7b1a77f8523042b0818ce475aa04d5c8d99cab7dc029cf0a2ca5f9cf94a837d6efcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLL1mjs9.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/636-136-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/636-338-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/636-134-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/636-130-0x0000000000710000-0x000000000085E000-memory.dmp

Filesize
1.3MB

Download
memory/636-138-0x0000000005C80000-0x0000000005E94000-memory.dmp

Filesize
2.1MB

Download
memory/636-125-0x0000000072C9E000-0x0000000072C9F000-memory.dmp

Filesize
4KB

Download
memory/636-135-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/636-197-0x00000000069E0000-0x00000000069F2000-memory.dmp

Filesize
72KB

Download
memory/636-137-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/636-315-0x0000000072C9E000-0x0000000072C9F000-memory.dmp

Filesize
4KB

Download
memory/3012-529-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3012-322-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3012-131-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3012-569-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3012-680-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3012-337-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3012-692-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3560-129-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3560-0-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/5416-459-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/5416-458-0x00007FFD11390000-0x00007FFD113A0000-memory.dmp

Filesize
64KB

Download
memory/5416-457-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

Filesize
64KB

Download
memory/5416-456-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

Filesize
64KB

Download
memory/5416-454-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

Filesize
64KB

Download
memory/5416-455-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

Filesize
64KB

Download
memory/5416-453-0x00007FFD133F0000-0x00007FFD13400000-memory.dmp

Filesize
64KB

Download