xred | 0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Size

2.0MB
MD5

a163c7bc85bb9c2a1e55cf1bdbc6a334
SHA1

871c64f2c6297038ebbac6616bc535d09db38673
SHA256

0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590
SHA512

dec52080226cf1f16107750b5cccc500033ecd050d5ae022f640761d3f5f29cb6ba1c86d845c04ed4321319572a8924a9d72ce2c6bf7897c71744c99f9f55d23
SSDEEP

49152:qnsHyjtk2MYC5GDczMmPITYbNbNWo4kSH3OqtwIz3:qnsmtk2aFzFPIT4bNJFY3OqtP3

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
3384	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
1808	Synaptics.exe
3804	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4652	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	._cache_Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
916	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3956	msedge.exe
3956	msedge.exe
2652	msedge.exe
2652	msedge.exe
2556	msedge.exe
2556	msedge.exe
5488	msedge.exe
5488	msedge.exe
6872	identity_helper.exe
6872	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE
916	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 3384	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	83
PID 3396 wrote to memory of 3384	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	83
PID 3396 wrote to memory of 3384	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	83
PID 3396 wrote to memory of 1808	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	84
PID 3396 wrote to memory of 1808	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	84
PID 3396 wrote to memory of 1808	3396	0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	84
PID 1808 wrote to memory of 3804	1808	Synaptics.exe	85
PID 1808 wrote to memory of 3804	1808	Synaptics.exe	85
PID 1808 wrote to memory of 3804	1808	Synaptics.exe	85
PID 3384 wrote to memory of 2652	3384	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	88
PID 3384 wrote to memory of 2652	3384	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	88
PID 3804 wrote to memory of 4612	3804	._cache_Synaptics.exe	89
PID 3804 wrote to memory of 4612	3804	._cache_Synaptics.exe	89
PID 2652 wrote to memory of 2136	2652	msedge.exe	90
PID 2652 wrote to memory of 2136	2652	msedge.exe	90
PID 4612 wrote to memory of 2740	4612	msedge.exe	91
PID 4612 wrote to memory of 2740	4612	msedge.exe	91
PID 3384 wrote to memory of 2280	3384	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	92
PID 3384 wrote to memory of 2280	3384	._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe	92
PID 2280 wrote to memory of 1000	2280	msedge.exe	93
PID 2280 wrote to memory of 1000	2280	msedge.exe	93
PID 3804 wrote to memory of 4788	3804	._cache_Synaptics.exe	94
PID 3804 wrote to memory of 4788	3804	._cache_Synaptics.exe	94
PID 4788 wrote to memory of 4448	4788	msedge.exe	95
PID 4788 wrote to memory of 4448	4788	msedge.exe	95
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96
PID 2652 wrote to memory of 2056	2652	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
"C:\Users\Admin\AppData\Local\Temp\0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/watch?v=RfDTdiBq4_o
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd68fe46f8,0x7ffd68fe4708,0x7ffd68fe4718
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6073257720422131592,16049400306726068497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/app/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffd68fe46f8,0x7ffd68fe4708,0x7ffd68fe4718
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,9132532488195767762,11911641243380248982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,9132532488195767762,11911641243380248982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2556
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/watch?v=RfDTdiBq4_o
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd68fe46f8,0x7ffd68fe4708,0x7ffd68fe4718
        5⤵
        
        PID:2740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7597161408353037608,10194235325685741594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7597161408353037608,10194235325685741594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://keyauth.cc/app/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd68fe46f8,0x7ffd68fe4708,0x7ffd68fe4718
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,9080157092793456748,8759710523390910065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,9080157092793456748,8759710523390910065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5488
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start cmd /C "color b && title Error && echo Application not setup correctly. Please watch the YouTube video for setup. && timeout /t 5"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "color b && title Error && echo Application not setup correctly. Please watch the YouTube video for setup. && timeout /t 5"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4652

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
2.0MB

MD5
a163c7bc85bb9c2a1e55cf1bdbc6a334

SHA1
871c64f2c6297038ebbac6616bc535d09db38673

SHA256
0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590

SHA512
dec52080226cf1f16107750b5cccc500033ecd050d5ae022f640761d3f5f29cb6ba1c86d845c04ed4321319572a8924a9d72ce2c6bf7897c71744c99f9f55d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
49KB

MD5
65da8d6932ad74d3b51694b5a28dd0bb

SHA1
aa6e37cdacda153f499c299299a4dacf50c93765

SHA256
309ec80a404d5ba8c9816e0932bff343c8e205fe36819908682289ed7c7ae482

SHA512
bfce7ba0e18dde7d6f833709e565f704701d7a51b14d7c11b06cdce0b057290a334219c9aa4f7ea098c097eb779a2ceca397a9ad1ede0784348f78c81fd55015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
0969a5bfa836d5db83fd9f752cd87511

SHA1
687667a93a139b6864a4821a9f06498f964ded4e

SHA256
4b404b90be7d415c27386cc9f0b6670f71eb1d7b71e034b2d583629e669b11db

SHA512
b78e031bcbe76237e3a77d7aaca1ced733f8cd0677c0e4da1f8f3c762323b079a50759be431649516d3fea8b29c4f478f6ca54cc72e4c0339dad01398f724197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9cb6a10e052e08c6e11dcc5b353a7c8b

SHA1
b7476d140ed495954a537fead01ddb805802c203

SHA256
5c1d170d32dc137aaa0dc1aa8b7cf303b3201fc3e842a85074063f81f0ee63fa

SHA512
f746eda01c301d22f8aed9d7c1fb980d61443d9f4d64bac7434eba5d6413a883486a8e72b05d103dfe16a8d974854078733efc1ec7d1f1593886a0cad6113169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b275b0cbaf099e40b290c3c42715888

SHA1
aff631eeb288ed53d5f8aa00dd0b44c85f9f06cf

SHA256
2a19255783e99bb5742e009f27acbef6d072ebda7fee89059730716ea3c41328

SHA512
e55505a22754a9ced29ec50a75a214e5e3ca80c59d3364126a5bcc00d08e2e3883954aefb8a7e0267f7d25cd8f43cb8cbfd18b6ad0471d25ee6e6725af78397a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
15f6b1b3c2fe16d71d81c504b0b477c3

SHA1
7ce79a7fd08af9172fe58f30bebad1f3a0a8cc38

SHA256
688ce6ea2cf6b0d200f566c242f4a93d81bd88e966a29b2780d27b9dda6897b2

SHA512
5a8940169f427b3a2ed84ae5709ea4532208f9f39f24ea477458218653692ad5a8117fba71235c37be9c21ff2ebb2fca059283dc9764396259c1ae29e2004d0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0018ac095119178d253555efa31b3bf2

SHA1
9a33160016943ae6addab5ed15906e6b1baf54f7

SHA256
d9c119947b6ba5874837aa90e13b28cae314bf9cabb7f500293208fc5288b1f0

SHA512
67f99a7e8c05bebe97099976e91041df8a46cece10a26e30f36a3c72b448937a6df4517622da4d4612744bb8df4af61d2fa85d38616bd8f693c6d7a8d9b5e0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f18ca7b1-4c96-4901-8cc0-5c47707f0af2\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
1e1bf89f78404ad80dfdc2364d95d817

SHA1
06671ac80fcaedd80f9890756b10e82cd17213af

SHA256
acc10098a17e86677a83d280c73617b82871dfdfbad9a367376fa206625ad90d

SHA512
4ba1dae57a54d00b0e58b5ceb6a633aed90504f0d236669e4b4d3482f06bb8f35db986ab1986319c333df3e220135c17f883a6c4cdca627cd9576318c809dc32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
3d82b6d81a24787c609ef37d262c5fef

SHA1
65b8bc68dcea45ccc5570237fea503db4082db5c

SHA256
6a0ad1d7fd07d67da1d02038714c7bfe57d217856a9ee2badfb5434f1c8e67a0

SHA512
d94b4767a730a780a1e3cb080307c075ef9326cfd08e49b28a3008b9117ad50913ebdd8f5964033522d7e82ec9b08106f1cbd30a8e3da3982705fed7ddff7209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
19568c07cdfff33f9a9fafecc42d9e80

SHA1
2f15c7227b50785917b8cd7a08a5bfb1e71f586d

SHA256
2f98c969bbede34d385e53dc4e7841d4a4f33fc60795bd76162f777a69806ee8

SHA512
2787328e114c1a90970fffe8f2717eb9ecf66e5aa93f8146c491448f4d5ad432240db6686c1ceb4d6fe894ca8f758ea791d54d8b88168a24f0eb1f130a1ccf4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
18f8556888de7ad7fcf614027b0e7c1f

SHA1
2348b832e8c770ac88769ca55174f43f75b19034

SHA256
78c8c9166c69e1bfb5ef7cd865cb9bee6474b676ca17ee3483b70bd1ecd7aab4

SHA512
70b1a23eca165356c0cc68f7bc3214da4ce74a0daf307be9efb1e4509e0ff9d4bb301992086d465c945560442089ea6f5ab0dbf1f1dd32d2b42bc823f9d96204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
7ea50ca6b01fdc3e00fc7eed61f28b59

SHA1
4c6c84b77f492a03652030cc89109fddece9b000

SHA256
54da034b42a93c2ed7aeaf83cde9cec3d58a9646e10974029bf20099035ef4d3

SHA512
ea56311255bf2d6ba090ebf662d866e1f66a2ef4b255fd2ab40e97e2c1966298edf192e5e8373a56e167fcf4e563ec1292ed7fbe2204421890dd2dd97023a18f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57ad95.TMP

Filesize
89B

MD5
a93b14707f41d55ed5595dacfa60cc11

SHA1
ea2a77ecacd945e23d050d50b16ff1511088e218

SHA256
993613946e8eadac2a29a35d6137bc72402ae7e435e5a651a82bc34d3ffefc25

SHA512
42ef01e3cf877ea3045206eddf5fa142a7692c2992bc94ed79c025545168cf999754a6ab40ff1b6848bf2122f6cff26a26f0262904b23d111f0f082911be5d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3e5c4e60b8171308a642c9d8b51c77ae

SHA1
dbd8f425f4b44b3c4f0366b6467130936d659ff9

SHA256
77217d0d762b03756519b3c1ef74804089570c57100535262c84b49b7b5a5f84

SHA512
0a3fb212940acffb0ee1d641cc1e0f4fbbc1203ab0f8153f309b4aedab6f74d3fb2c5d4c0d64109edcfacd64e3e9f78b1b81781510e091e01d93aaf031fcf58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fc52.TMP

Filesize
48B

MD5
1ea244889f7489216090bbb4c69d0912

SHA1
36e9060035c5430bea6a462dcbaf56f946d0467b

SHA256
f937383bbf5e7eedab5fcf6cc519c08d7f13b63037bc7608f8b95bda53858aca

SHA512
790d73d28a1891805e787885cab5632f93db382a66a5c268befcf3a6f438516f897afe6d69102e00ea5d65784ad29f449c29cffc2f8a4a8861f47e9ba9b0115f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
42c8359aad8ba95cc2ed19ad18085c96

SHA1
c6b1e7aa3cdd6d4a27f4e5e07ad94e3ef547e324

SHA256
027629dc8418fc9fe4694ed8a2d2409fc3b0c282844560f1f7f83abbd33595a7

SHA512
515cb1e441c491939718ec972f0e5e0d50baff9181c599d4f8052d374afcddf2359d88f2f8da92b6e7ee9dc0c84acfd18aed98e7248fd4793a30894daf44c036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f433.TMP

Filesize
873B

MD5
7036db4085da294b09da6fd5392aa5b5

SHA1
3f7d298dc84e4f168d5c9026c68567163f6ceeab

SHA256
6695402be2a2a4a52376fcec45ff8d5e6e5de5e0a9536092f5303087ff5181a3

SHA512
92353b58e8f5207bc692ad5ea49d337c6c8e752cb6f760ce9e99936a5920726ff73c34f0d6b033dbd33ea5896a37e7b0d482f2762993f2f786b73103a2c30ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7893743129f8aa5dd320dd33292a5cf4

SHA1
5ee661784e24e6b2006554f26670495dd2b938c3

SHA256
78f3e70c818e3ecde9158bbae8667f96233ecde3971c9e6c5e8357236765d9b8

SHA512
f9d92383686f6666cbf953124ac77d56aa798a93d31cadc3637f17b6bbcf572c7338cd3f7d08bd1f503718dc93343150b7be20356a26ac642dc4fbe9c3016dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
932a497f810bebcce79f716d67806e32

SHA1
57fed40763f311ec056f3551e36329700b8c8098

SHA256
539dca0e16e6c4c72b618ef0ab7290e69f97c3be506b334872af3d188b2c5ff5

SHA512
9726d85160964fdcaf746457ae280231784fea5db6e02f6ff95323b8146ad71fe2396fe1b3ad2197c7d4fd02ee003066803a68d44e4c88577e225fd6e9695579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
3947b02bf5bf36f3bc2ba9d1294dcd3d

SHA1
11f5657d02c9fa7187566aa40889b93169d5db42

SHA256
e8341eaccfc8558b21ae5a956da748c461f976ef4a0e460fac81828c99d1bc7e

SHA512
ea8c3462dea5991b415f3472ca7b556141e9a82b102d5ccc762bbf875a69acb2684bb0e4fe17b333cce670a6e8bf2e0dc13d180a8c89fe3764468850958f7366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d73beb670f69022e08c7a0b2b2bd91d2

SHA1
54c7e57ff86fee182713d236945bcf2a6a730b1e

SHA256
f465d163ca4ff4cdd1681e9d1a0e17a7e5b76dd2a6d74dd5fa4783a132adc76f

SHA512
2f9e72c18a81488a727094ed5801f80053748f7592fab6d4bb7577fc50c94af95125df923621b92f5abe0c2d1e44bd7ee6d8918686d2d4c4a0872c6d4fce1462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
9d9078946c2d101691844182b56bb5d1

SHA1
8ccb8adbac2c7fe59633baec4433c88be9ff035d

SHA256
3a4a6fe3d9d366a298de4ce07e7589f87216003af762b00ac7fc1627e1e559c6

SHA512
9a2a60698818ea21701a7d2fc96a4caae067c44dbda9a51d61733c38551eb2cc8d75bdc1eaba1a36a39ca8dc2bb4dd73366b128f9619a725825dd79fd44cb469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
0ea6127d069e8746a486340d13817d2e

SHA1
7332f39cab59f7d2c0b6a76b42db0343657d268f

SHA256
f13ac89d99804db47068864af806dc235693815c871f7c2ad7b74d60b7c2f074

SHA512
859a873353713e0b80309b1011c9d5feebd5288a66d36c51240c726be373352e6c3d72afe67a245ca0a82531c93362169dfae8764f447f3f189bf93346938233

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_0606279933789b017a32a8b929f24524647249029e68c51b0b05386bb7c86590.exe

Filesize
1.3MB

MD5
b9773451b024cd03b844bc09cd17a3f4

SHA1
c3b11a40d7e141b1712e89ec6f4d0a7a273f7e6f

SHA256
8a1cda86fda420345e59cf46954aa2ac713a4549d2d2a2f36f27c0f5f01a1a82

SHA512
44923981b897fa080684960375eb5dcf562e86b1de012126ccad8bcd147e0b78eded1dec00faacef8a273355d553829f6e7c1ac101c6ccde8d976426b952312b

Download Submit
C:\Users\Admin\AppData\Local\Temp\26975E00

Filesize
21KB

MD5
447e3d75f44899bb64966466a6d14aa5

SHA1
6753bdca82c49a16a81105e167e29578d51967ef

SHA256
0c05f4a4ad37d9327e6df503c7a5c958e0c051429f3571940a2903440a7549e8

SHA512
134e92fae43b92836dbe8834c2b86b50fc78dbe27247b37a6d74e860a12e465b17873c7c2dc3c484edd4796eca1979727169ee21cec2b7c427d4a6d5e4d9a008

Download Submit
C:\Users\Admin\AppData\Local\Temp\EC8yOGik.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
memory/916-197-0x00007FFD4D3B0000-0x00007FFD4D3C0000-memory.dmp

Filesize
64KB

Download
memory/916-200-0x00007FFD4D3B0000-0x00007FFD4D3C0000-memory.dmp

Filesize
64KB

Download
memory/916-199-0x00007FFD4D3B0000-0x00007FFD4D3C0000-memory.dmp

Filesize
64KB

Download
memory/916-204-0x00007FFD4AB00000-0x00007FFD4AB10000-memory.dmp

Filesize
64KB

Download
memory/916-198-0x00007FFD4D3B0000-0x00007FFD4D3C0000-memory.dmp

Filesize
64KB

Download
memory/916-202-0x00007FFD4AB00000-0x00007FFD4AB10000-memory.dmp

Filesize
64KB

Download
memory/916-201-0x00007FFD4D3B0000-0x00007FFD4D3C0000-memory.dmp

Filesize
64KB

Download
memory/1808-622-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/1808-763-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/1808-431-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1808-133-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1808-466-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3384-191-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/3384-192-0x00000000057F0000-0x00000000057FA000-memory.dmp

Filesize
40KB

Download
memory/3384-190-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/3384-134-0x0000000005DD0000-0x0000000006374000-memory.dmp

Filesize
5.6MB

Download
memory/3384-126-0x0000000072B0E000-0x0000000072B0F000-memory.dmp

Filesize
4KB

Download
memory/3384-130-0x0000000000C00000-0x0000000000D4E000-memory.dmp

Filesize
1.3MB

Download
memory/3384-193-0x0000000005AD0000-0x0000000005CE4000-memory.dmp

Filesize
2.1MB

Download
memory/3384-467-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/3384-203-0x0000000007310000-0x0000000007322000-memory.dmp

Filesize
72KB

Download
memory/3396-0-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3396-129-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download