agenttesla | e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
Size

858KB
MD5

42cf5b6a353e075197a827020924854a
SHA1

08daf826ddfa2f5f0a611968bc98e8ba7f01016a
SHA256

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67
SHA512

825bbae160277fb57cdf00d5d206265c6206552d748ff8b9e9c3a9ed4dea974ab79963f038ee1024b587b1d5fde0e767587009063917da4dc7b61b6e6deee72e
SSDEEP

24576:/EN973phvt8tmUdkw1xG8fFjGMaOnO+pwFL9N09PPb:/EN973PvEL2wHBODLcPj

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2076-2-0x0000000001680000-0x00000000016DE000-memory.dmp	family_agenttesla
behavioral2/memory/1724-106-0x0000000000400000-0x000000000045E000-memory.dmp	family_agenttesla
behavioral2/memory/4608-187-0x00000000004D0000-0x000000000052E000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemighost.exemighost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	mighost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	mighost.exe

Executes dropped EXE 4 IoCs

Processes:

mighost.exemighost.exemighost.exemighost.exe

pid process

3104 mighost.exe
1724 mighost.exe
4836 mighost.exe
4608 mighost.exe

pid	process
3104	mighost.exe
1724	mighost.exe
4836	mighost.exe
4608	mighost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/644-0-0x0000000000430000-0x00000000005CE000-memory.dmp	upx
behavioral2/memory/2076-7-0x0000000000430000-0x00000000005CE000-memory.dmp	upx
behavioral2/memory/644-32-0x0000000000430000-0x00000000005CE000-memory.dmp	upx
behavioral2/memory/644-58-0x0000000000430000-0x00000000005CE000-memory.dmp	upx
C:\Users\Admin\cdp\mighost.exe	upx
behavioral2/memory/3104-104-0x0000000000640000-0x00000000007DE000-memory.dmp	upx
behavioral2/memory/3104-137-0x0000000000640000-0x00000000007DE000-memory.dmp	upx
behavioral2/memory/3104-147-0x0000000000640000-0x00000000007DE000-memory.dmp	upx
behavioral2/memory/4836-186-0x0000000000640000-0x00000000007DE000-memory.dmp	upx
behavioral2/memory/4836-216-0x0000000000640000-0x00000000007DE000-memory.dmp	upx
behavioral2/memory/4836-235-0x0000000000640000-0x00000000007DE000-memory.dmp	upx

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/644-32-0x0000000000430000-0x00000000005CE000-memory.dmp	autoit_exe
behavioral2/memory/644-58-0x0000000000430000-0x00000000005CE000-memory.dmp	autoit_exe
behavioral2/memory/3104-137-0x0000000000640000-0x00000000007DE000-memory.dmp	autoit_exe
behavioral2/memory/3104-147-0x0000000000640000-0x00000000007DE000-memory.dmp	autoit_exe
behavioral2/memory/4836-186-0x0000000000640000-0x00000000007DE000-memory.dmp	autoit_exe
behavioral2/memory/4836-216-0x0000000000640000-0x00000000007DE000-memory.dmp	autoit_exe
behavioral2/memory/4836-235-0x0000000000640000-0x00000000007DE000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemighost.exemighost.exe

description	pid	process	target process
PID 644 set thread context of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 3104 set thread context of 1724	3104	mighost.exe	mighost.exe
PID 4836 set thread context of 4608	4836	mighost.exe	mighost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1828 schtasks.exe
4784 schtasks.exe
216 schtasks.exe
Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

3692 msedge.exe
3692 msedge.exe
952 msedge.exe
952 msedge.exe
1820 identity_helper.exe
1820 identity_helper.exe
2676 msedge.exe
2676 msedge.exe
2676 msedge.exe
2676 msedge.exe

pid	process
1828	schtasks.exe
4784	schtasks.exe
216	schtasks.exe

pid	process
3692	msedge.exe
3692	msedge.exe
952	msedge.exe
952	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemsedge.exemighost.exemighost.exe

pid	process
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
3104	mighost.exe
3104	mighost.exe
3104	mighost.exe
4836	mighost.exe
4836	mighost.exe
4836	mighost.exe

Suspicious use of SendNotifyMessage 33 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemsedge.exemighost.exemighost.exe

pid	process
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
3104	mighost.exe
3104	mighost.exe
3104	mighost.exe
4836	mighost.exe
4836	mighost.exe
4836	mighost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exee81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exemsedge.exe

description	pid	process	target process
PID 644 wrote to memory of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 644 wrote to memory of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 644 wrote to memory of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 644 wrote to memory of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 644 wrote to memory of 2076	644	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
PID 2076 wrote to memory of 952	2076	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	msedge.exe
PID 2076 wrote to memory of 952	2076	e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe	msedge.exe
PID 952 wrote to memory of 752	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 752	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 472	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3692	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 3692	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe
PID 952 wrote to memory of 4992	952	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
"C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe
"C:\Users\Admin\AppData\Local\Temp\e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
4⤵
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
4⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
4⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
4⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
4⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
4⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
4⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
4⤵
PID:612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
4⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
4⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
4⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
4⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
4⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
4⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
4⤵
PID:612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
4⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
4⤵
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
4⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
4⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
4⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
4⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
4⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
4⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
4⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
4⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1290096983376415659,8549215946707123107,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3400 /prefetch:2
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e81efea1ee8a5db71fd76af8c8acb4aa734f8a5f5e933ed67f3bee470820dc67.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:2216

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3104

C:\Users\Admin\cdp\mighost.exe
"C:\Users\Admin\cdp\mighost.exe"
2⤵
- Executes dropped EXE
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:5032

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Users\Admin\cdp\mighost.exe
C:\Users\Admin\cdp\mighost.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4836

C:\Users\Admin\cdp\mighost.exe
"C:\Users\Admin\cdp\mighost.exe"
2⤵
- Executes dropped EXE
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=mighost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
3⤵
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
4⤵
PID:3992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn TRACERT /tr "C:\Users\Admin\cdp\mighost.exe" /sc minute /mo 1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7bffdaa537fca108840d03ed936cb5a3

SHA1
60b3ec9aefd8e272cde9dbb2ac6a1b8a187c8ccc

SHA256
9e9bf7b9e2150420331731dffdc79708f414a968b9c6b1fdb1b3a1ff1d605f24

SHA512
5479753b1695088a7f49f2cb0ffe9f6035dc38f4328972941e8c80dbe443a143b7399dc137125a8b7a61d1026cf267abbdde0b7e08ad3d6275f2f1e723191321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f907990c3511ff2a9357fde98dc27d11

SHA1
9e76771d7d7fd67174f56e5fdfbed88c1a0f6a11

SHA256
c6003e558801c8adfc898243eb763e3c9639671f1902895add805fc5178d1ce4

SHA512
ed8fe974c4aa0666c900f00501301c1d56ecbd94cde1fec3fde5c9548a695831f659f0e746fccf4c0802be9b653f9bd9e40a94d3e64f2cfaa2078eff42e85f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
ffd255d7e3eca6d0345967f7f11eb801

SHA1
4c5a59d23deb1746cb9f3c8406b02041ebdb0aea

SHA256
19ac9d7d2ad6f3af8e24cb74966e2088779831ae66a135a24e89fecf4b8eb1c5

SHA512
5b03bd28f58a74388329e6c1f264b4ccc77dee6623d3f3b022ffcd3bbec2fb269b271379ef26a96dbd6b8590c1706f836fa92d7f7c8f4aac788ef3f5bffb2da0

Download Submit
C:\Users\Admin\cdp\mighost.exe
Filesize
858KB

MD5
fbf184ed1128806cb7f880d10ef6a449

SHA1
3d7618bd2f4b15228edd66a6f8dfde720fea43ae

SHA256
6ae6d09804e715087c0a4376e2df285aff9ab10d20fdf033ef78f152bf25693e

SHA512
e4456222e0bcde47147b29f00e1328ca236a3cab5c6a3a4f00863785e4aeb103c044adcb3ea5fe1b97a7632fd10e10f709eb9f17343f0e612076610a5ddb2eeb

Download Submit
\??\pipe\LOCAL\crashpad_952_XEZWWLNEXYOGQKBY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/644-0-0x0000000000430000-0x00000000005CE000-memory.dmp

Filesize
1.6MB

Download
memory/644-58-0x0000000000430000-0x00000000005CE000-memory.dmp

Filesize
1.6MB

Download
memory/644-1-0x00000000018A0000-0x00000000018A1000-memory.dmp

Filesize
4KB

Download
memory/644-32-0x0000000000430000-0x00000000005CE000-memory.dmp

Filesize
1.6MB

Download
memory/1724-106-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2076-2-0x0000000001680000-0x00000000016DE000-memory.dmp

Filesize
376KB

Download
memory/2076-7-0x0000000000430000-0x00000000005CE000-memory.dmp

Filesize
1.6MB

Download
memory/3104-104-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download
memory/3104-137-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download
memory/3104-147-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download
memory/4608-187-0x00000000004D0000-0x000000000052E000-memory.dmp

Filesize
376KB

Download
memory/4836-186-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download
memory/4836-216-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download
memory/4836-235-0x0000000000640000-0x00000000007DE000-memory.dmp

Filesize
1.6MB

Download