Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 03:52

General

  • Target

    8e782ef613f5ac65f52cdd8cf316acbf.exe

  • Size

    1.2MB

  • MD5

    8e782ef613f5ac65f52cdd8cf316acbf

  • SHA1

    d5d4933a6b97359f6505a459178d5473ec1940ec

  • SHA256

    dacf04a6064ab88cefee0ad303e750a28986b565157c0eb19d01cc20ab33ec1d

  • SHA512

    e7c96b4f1ae480269c552c5b5c06dd0c8c53bb0b24678ebdc4a0b67463f63c2421f3b5ef9466c67b69ee6d5e84b358f8411679f4c1d042e3f7197d00ae4da089

  • SSDEEP

    24576:/yBrC8+VGd4QQvKCWh1WzRmlJ8yX4Pz3lP5MTDucs:KpCfGhYWh1WzRmvO8TD7

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e782ef613f5ac65f52cdd8cf316acbf.exe
    "C:\Users\Admin\AppData\Local\Temp\8e782ef613f5ac65f52cdd8cf316acbf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XO0UY05.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XO0UY05.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1VN46DW0.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1VN46DW0.exe
        3⤵
        • Executes dropped EXE
        PID:3392
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 608
          4⤵
          • Program crash
          PID:1552
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4uZ060Ph.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4uZ060Ph.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:320
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6lt1Zt1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6lt1Zt1.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
          4⤵
            PID:3408
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2716148501443448089,14155121109352770470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
            4⤵
              PID:1080
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2716148501443448089,14155121109352770470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
              4⤵
                PID:1000
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                4⤵
                  PID:664
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,6431041621899010973,10807172149070883547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
                  4⤵
                    PID:5736
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6431041621899010973,10807172149070883547,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
                    4⤵
                      PID:6092
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1208
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x80,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                      4⤵
                        PID:4364
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,459911885392199481,1313990522233921767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
                        4⤵
                          PID:3912
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,459911885392199481,1313990522233921767,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
                          4⤵
                            PID:4600
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3392
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                            4⤵
                              PID:2564
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6094048601080686050,16334585481907789078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                              4⤵
                                PID:6208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6094048601080686050,16334585481907789078,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                4⤵
                                  PID:6200
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                3⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:4956
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                  4⤵
                                    PID:2444
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                    4⤵
                                      PID:4448
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                      4⤵
                                        PID:3900
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
                                        4⤵
                                          PID:6084
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                          4⤵
                                            PID:6636
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                            4⤵
                                              PID:6624
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
                                              4⤵
                                                PID:6916
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
                                                4⤵
                                                  PID:7136
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
                                                  4⤵
                                                    PID:7284
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
                                                    4⤵
                                                      PID:7792
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
                                                      4⤵
                                                        PID:7968
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
                                                        4⤵
                                                          PID:8088
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                                                          4⤵
                                                            PID:7812
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                                                            4⤵
                                                              PID:6228
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                                              4⤵
                                                                PID:7848
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
                                                                4⤵
                                                                  PID:8216
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
                                                                  4⤵
                                                                    PID:8320
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
                                                                    4⤵
                                                                      PID:9052
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
                                                                      4⤵
                                                                        PID:9060
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7636 /prefetch:8
                                                                        4⤵
                                                                          PID:9148
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7636 /prefetch:8
                                                                          4⤵
                                                                            PID:9164
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
                                                                            4⤵
                                                                              PID:8284
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
                                                                              4⤵
                                                                                PID:8308
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
                                                                                4⤵
                                                                                  PID:8660
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
                                                                                  4⤵
                                                                                    PID:9016
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7980 /prefetch:1
                                                                                    4⤵
                                                                                      PID:8908
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,5852215041602620851,2862393804409056849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7780 /prefetch:2
                                                                                      4⤵
                                                                                        PID:5320
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                                      3⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3684
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                                                                        4⤵
                                                                                          PID:2348
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,2798214285566203816,12122164566231402658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
                                                                                          4⤵
                                                                                            PID:3596
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2798214285566203816,12122164566231402658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
                                                                                            4⤵
                                                                                              PID:2520
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                            3⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3500
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                                                                              4⤵
                                                                                                PID:3040
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2104659898739566398,11620384196159986152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                                                                                4⤵
                                                                                                  PID:5948
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2104659898739566398,11620384196159986152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                                  4⤵
                                                                                                    PID:4084
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                                  3⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4684
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                                                                                    4⤵
                                                                                                      PID:1864
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,6329046896105458542,409921446959659099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                                                                                                      4⤵
                                                                                                        PID:6224
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,6329046896105458542,409921446959659099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                                                                                        4⤵
                                                                                                          PID:6216
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                                        3⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1584
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                                                                                          4⤵
                                                                                                            PID:4708
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,5554190360925015473,14717117755695995083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:6676
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                                            3⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5308
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x104,0x16c,0x7ffa692a46f8,0x7ffa692a4708,0x7ffa692a4718
                                                                                                              4⤵
                                                                                                                PID:5348
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15694192004426147843,15933689730691222137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                                                                                                                4⤵
                                                                                                                  PID:5404
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3392 -ip 3392
                                                                                                            1⤵
                                                                                                              PID:2488
                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:7804
                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:4584
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\B7F.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\B7F.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:6284
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\476B.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\476B.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:7348
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                                    2⤵
                                                                                                                      PID:7296
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                        3⤵
                                                                                                                          PID:7844
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                        2⤵
                                                                                                                          PID:6648
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                          2⤵
                                                                                                                            PID:8100
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                            2⤵
                                                                                                                              PID:3108
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-6V7F7.tmp\tuc3.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-6V7F7.tmp\tuc3.tmp" /SL5="$F021E,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:9000
                                                                                                                                  • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                    "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                    4⤵
                                                                                                                                      PID:3796
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                      4⤵
                                                                                                                                        PID:2464
                                                                                                                                      • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                        "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                        4⤵
                                                                                                                                          PID:8208
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                          4⤵
                                                                                                                                            PID:8740
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 helpmsg 1
                                                                                                                                              5⤵
                                                                                                                                                PID:2416
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                          2⤵
                                                                                                                                            PID:228
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4FF8.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\4FF8.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3600
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\AB96.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\AB96.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:4560

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\ProgramData\SpaceRacesEX\SpaceRacesEX.exe

                                                                                                                                            Filesize

                                                                                                                                            1.3MB

                                                                                                                                            MD5

                                                                                                                                            6fd8416a8283d2b8e9e07849389240e2

                                                                                                                                            SHA1

                                                                                                                                            7b1199727ddfce41daca65c14dc46bf9b4c73653

                                                                                                                                            SHA256

                                                                                                                                            3c01fbbf42a07df2f5fdc7041c68520197f431454d068b85801ea5f756316406

                                                                                                                                            SHA512

                                                                                                                                            a11f7189a04025a1c0f67e025996b38e5537298885bf39f6eb211c20e7e2f7bf328a1996c3e69d00a8e0033dccbadca1167f78dd9c8bac1cdd224b60334d994e

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\557b127f-9cdb-4fd4-9797-51864383e21a.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            bc134f40d54547a3275dc0de5251cf11

                                                                                                                                            SHA1

                                                                                                                                            1c863ada97fd9ab922b487035cf7684cab906b04

                                                                                                                                            SHA256

                                                                                                                                            fb4218559eef00ceac93761a6fca0eb904949f82f954daf8cde961fc993d4d4c

                                                                                                                                            SHA512

                                                                                                                                            af87e63b94a61e9016bc392f83ce6990001d12b632dfd511db8b7707584acc57f3ed2baa4668563511606be6d94036d59815447105ac89142129f051e81ed6b3

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            5990c020b2d5158c9e2f12f42d296465

                                                                                                                                            SHA1

                                                                                                                                            dcb52612d301824d3a7fdfd0ea20c3fcfbb7a1b4

                                                                                                                                            SHA256

                                                                                                                                            2f33956ce5a0bb01abb3c0fee9a321c8f8f7abcf1d7535800bf25f1dc44b1643

                                                                                                                                            SHA512

                                                                                                                                            9efb70c4922365967c5fa7e89967e21eede96979a149e027099da786cd8b198d4e81bb3bf2b39c8d65a8796c5d72ca79241e66fc69e2502fdec8a0c5f230412c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            208a234643c411e1b919e904ee20115e

                                                                                                                                            SHA1

                                                                                                                                            400b6e6860953f981bfe4716c345b797ed5b2b5b

                                                                                                                                            SHA256

                                                                                                                                            af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

                                                                                                                                            SHA512

                                                                                                                                            2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                                                            Filesize

                                                                                                                                            20KB

                                                                                                                                            MD5

                                                                                                                                            923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                            SHA1

                                                                                                                                            6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                            SHA256

                                                                                                                                            bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                            SHA512

                                                                                                                                            a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                                                            Filesize

                                                                                                                                            21KB

                                                                                                                                            MD5

                                                                                                                                            7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                            SHA1

                                                                                                                                            68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                            SHA256

                                                                                                                                            6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                            SHA512

                                                                                                                                            cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                                            Filesize

                                                                                                                                            73KB

                                                                                                                                            MD5

                                                                                                                                            6dfb28a6390f63171f06e77ea2e7465a

                                                                                                                                            SHA1

                                                                                                                                            415dbb91566f810a83c3c6efa2e4dd2c4084c276

                                                                                                                                            SHA256

                                                                                                                                            3cfe4ed506d1ee431d75dfab4e2f1ada2fd30e8d7664061d9fd706b3ed9c4b98

                                                                                                                                            SHA512

                                                                                                                                            333b19faaa15c61ee44793bb4c2222663070ebf6463fb85115f561bba0abff09ab8a88f5dcad8f31ccc496b42930d137c865515c78ecb0a0adf994d64354ba56

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                                                            Filesize

                                                                                                                                            33KB

                                                                                                                                            MD5

                                                                                                                                            909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                                            SHA1

                                                                                                                                            feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                                            SHA256

                                                                                                                                            dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                                            SHA512

                                                                                                                                            b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

                                                                                                                                            Filesize

                                                                                                                                            200KB

                                                                                                                                            MD5

                                                                                                                                            b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                                            SHA1

                                                                                                                                            19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                                            SHA256

                                                                                                                                            8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                                            SHA512

                                                                                                                                            86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            111B

                                                                                                                                            MD5

                                                                                                                                            285252a2f6327d41eab203dc2f402c67

                                                                                                                                            SHA1

                                                                                                                                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                            SHA256

                                                                                                                                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                            SHA512

                                                                                                                                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            3KB

                                                                                                                                            MD5

                                                                                                                                            456f54b4951d59f62f68ae0c2bc4a26f

                                                                                                                                            SHA1

                                                                                                                                            65932c67805edf74da2c8c758688848e1202670d

                                                                                                                                            SHA256

                                                                                                                                            3ec5dae06cde1adaea7703cbed5185edf839657bc7b80ff1580bd99ac45da346

                                                                                                                                            SHA512

                                                                                                                                            2850b854b7409116779eab067c4d3f82f4474aeed12a24f97ece53e9f5ba4b9818b53ddf9058b98f3ac12f1f9a6bc042640afb604eaff08f46b08e96f246a7f8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            5KB

                                                                                                                                            MD5

                                                                                                                                            d62e119ccb5d99384bcd549f9b888f7e

                                                                                                                                            SHA1

                                                                                                                                            4056b7749bcbe0b394e0f061b92205cd0a13fc01

                                                                                                                                            SHA256

                                                                                                                                            b5e46f12a368a37556cc233df98d46fe49b815b7649e6fbad0b07617b7107581

                                                                                                                                            SHA512

                                                                                                                                            03fff307de02e254d8e4524f9c9af9c70b68508861f3212867dbdc41c6fce50333f80aba697c465f3245276db180857c087da378b63e52ffa11275b76c43ac60

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            9b4fc132c8e54d0fbc71e07bf2d2453e

                                                                                                                                            SHA1

                                                                                                                                            174a5590ce7b239ae2d8e9bbab28907e4e807c9b

                                                                                                                                            SHA256

                                                                                                                                            3db443bb9d89655d60006b26dc1ddcfb05367f02dece82b101ef46f8bb3cf834

                                                                                                                                            SHA512

                                                                                                                                            b50ff3b7b4a8f27da6cfc3ddea6f2c9429c72928eca66e7280bb630e3ffdbe94a0082a145f4b13fb847639e9ecc2206b45326ba1adb11c72d02408edec2e0aa5

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            4d63bbd37c1e633e5f54aa3097988aa6

                                                                                                                                            SHA1

                                                                                                                                            fbeba2d2dc077429f691a3d54046112851769d1d

                                                                                                                                            SHA256

                                                                                                                                            d8258560e7712803fd6fd5bcf6cf1576202cd665da0557f8d07a931f90f1ec08

                                                                                                                                            SHA512

                                                                                                                                            695f91a29f1cb941526e393ccc071e030b392e998b91b13a3bc2b9be86d67d0a5c00da985476f12cf37ce7012c864b10b6f7b11450bb462263c6eee69059fc9d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            7343c9b18174eb3fa93b11f2f18b160f

                                                                                                                                            SHA1

                                                                                                                                            858548be75330aa4e865b434dfee219268779ba6

                                                                                                                                            SHA256

                                                                                                                                            7e1de2c4a3e98811317ff9829622ad262262543b35c7e37f8167aac157452d89

                                                                                                                                            SHA512

                                                                                                                                            18cf1f3eae9213b7ec8a2e7dc61d5a1bc6a36de6160107961e49248c8f4aeecb308774968d9f6169f9ecf84f1db0321791861af92985bbbaea866ee9a99c974b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            9KB

                                                                                                                                            MD5

                                                                                                                                            2daf7ae30833be40655275c63cb0bad1

                                                                                                                                            SHA1

                                                                                                                                            097dcea0b0968e35e064bed3b2117d0b1ba849c4

                                                                                                                                            SHA256

                                                                                                                                            c460fe423221bb07671c1c3b35bdd174c02a5e0fe4c2af5f63ff4d7d3ce46a6f

                                                                                                                                            SHA512

                                                                                                                                            e1ad17eb1266ec59fcf9b952d8367e76894899df2b24ff1419414643506c2b4e1fb53155203d8e4c98ed97b48feebd4c89ffcc1d9ca0c9eaf2f1384170a81e33

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                            Filesize

                                                                                                                                            24KB

                                                                                                                                            MD5

                                                                                                                                            5a6206a3489650bf4a9c3ce44a428126

                                                                                                                                            SHA1

                                                                                                                                            3137a909ef8b098687ec536c57caa1bacc77224b

                                                                                                                                            SHA256

                                                                                                                                            0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

                                                                                                                                            SHA512

                                                                                                                                            980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            c95387548d35e5cda3d1106da199ffcf

                                                                                                                                            SHA1

                                                                                                                                            5d294067b0b4c2eaf86c9875854e3d7fea8c6e87

                                                                                                                                            SHA256

                                                                                                                                            69ca6d16b86ebabfd7c05e9ccebff79e9c9bdd198850cde93ba398fdef9095d1

                                                                                                                                            SHA512

                                                                                                                                            cefa6a7223db2f532d7e5eb89258e761ca78695cdab5580398f5f7c14a96aedcae96e0a0ec7c72942e3a426bd6f58a8a7ce3cf1af0203082afe4fc68ccaa922d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            79d32fc2fda4e78aedf5dba5cf00a83e

                                                                                                                                            SHA1

                                                                                                                                            9adf1b740096a5302ec845d5c2ecf6a4431e9d4d

                                                                                                                                            SHA256

                                                                                                                                            7b20a0ca41f13190b3e4a816722ffc8b88a59c7416cf29000d37d74e73f29820

                                                                                                                                            SHA512

                                                                                                                                            23f71a4e3c44432d75c4adaaacbef913b712e124651c93b560a7e0a76c9fe98bbd1fe0818d7f769efeda6b9b6357927860fe1c10b8ad8346804412124898731b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            475ca263834a83103028cf47110ddea7

                                                                                                                                            SHA1

                                                                                                                                            eb6c6ac76796b80a7e13c6580b749bffdafed794

                                                                                                                                            SHA256

                                                                                                                                            b2c4d3da48fbfe3afd567c5830f976caa71f885fbd89108c43591022652228cc

                                                                                                                                            SHA512

                                                                                                                                            e888238640256db45e2fb16382f91cbf5db6d10ad1a8650fc281e913573379abad0d96ff57168d7fe96fded4e08c0596d321eec5bdf797341670fe3cf35268a7

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            1f43a5c19e218d80b0dd36f81be4d550

                                                                                                                                            SHA1

                                                                                                                                            0d564d0565ffb864968a75b2dc8a8cef29005f03

                                                                                                                                            SHA256

                                                                                                                                            30f10bc0fbb0ae14390ae30ec1236ae5490235fe136bc6ff5da327a7ecd81e85

                                                                                                                                            SHA512

                                                                                                                                            3c1dd8d45c4c051bc9f6d45eef04c53903f3d7262b6c760b3d2f682a72e1518f1e085b56a57ece122c991130f66e47cf1aa2f380b77c76337799e9979a181801

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            39e4dd693422b05ea1fee0d6370c4a1c

                                                                                                                                            SHA1

                                                                                                                                            86f6c59a11f8531ff0af521ad73668d619ca7a1a

                                                                                                                                            SHA256

                                                                                                                                            6d51d70ca5f7ecf937d9e2b72ff016028f8207f930602ee5559520dc92a3002b

                                                                                                                                            SHA512

                                                                                                                                            67c0b2bbb3455cbc16ce4618932043ef6cc4f801ed3bc095777827ed0fc1726ab36e4ee3ff3261d69d0fa8cab02c198cbb28ba4faee800104e006405683b929b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            3KB

                                                                                                                                            MD5

                                                                                                                                            93fd0d97140eb54c5a1c76a1cf70af70

                                                                                                                                            SHA1

                                                                                                                                            363b17384c9fe304d005ef2935c7dfd874465cb0

                                                                                                                                            SHA256

                                                                                                                                            fb63cc370a41bb6b848fbcecc9850390eb6a631b9a32d38c16f91cf01d147a2f

                                                                                                                                            SHA512

                                                                                                                                            96c3d45b69ac7004b86e6874ebc155132afe7a10fc4061434ec18a79ce21615bd5740791bda48fccaa4f9c20082ccd5d174bc82bef77466806657befeef3166c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            a2ae246195dcff1180588f47ed120c0e

                                                                                                                                            SHA1

                                                                                                                                            1c285c4ae0579c6055f4b1b5fd2ad6fba78c85ed

                                                                                                                                            SHA256

                                                                                                                                            9416431554d8ca41b10759ae9233b5d3b83865a83b929779f90af7469a148a1d

                                                                                                                                            SHA512

                                                                                                                                            714cb11107d05443dded9862144066a730e19bcdeed13f85fc48ecb7d110c23bd2917b162ae3b248b5a653634a479ddc1c9114d2d455d9584c011192f96e2b75

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            3KB

                                                                                                                                            MD5

                                                                                                                                            1409443b4b1408b4d15bd47f7587929d

                                                                                                                                            SHA1

                                                                                                                                            7db479cebdbcebd454f5fcb5c1f53fa09401f7a4

                                                                                                                                            SHA256

                                                                                                                                            92276cb99571b1db05cb0092dc4c305525a7017ee455c08f0f771366ed8a6d28

                                                                                                                                            SHA512

                                                                                                                                            0b9b7e09b99f691264abbfb5ec97f10559ec1eb0eb58af6b2c3ee50efe9dee8b576396c5b2b1c87c9116669073291bd0a4898504bb31f409e905970def4ffb01

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5917b4.TMP

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            b122d2e9e2fa5e062636b4f6398d0c66

                                                                                                                                            SHA1

                                                                                                                                            beb5abaaa3492efec47a43bc2ff5af1268c8d0f6

                                                                                                                                            SHA256

                                                                                                                                            044a1b4ae6144f2b0590f5061770276c181318fe98e3aaa0c2e15c9c79c4288a

                                                                                                                                            SHA512

                                                                                                                                            4cd0215cdd790fa99a43e27f858b990fd436469363d92be5db3bb90f4aa9de4653aacf3e0e53dd8f21787954cf82beccc5626ae83a22cf54ad79e0aec0c751e8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                            Filesize

                                                                                                                                            16B

                                                                                                                                            MD5

                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                            SHA1

                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                            SHA256

                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                            SHA512

                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            6db82b857d78d2123b8d0c5983f533a2

                                                                                                                                            SHA1

                                                                                                                                            dd5f5be97da59bd23f7088868b8111dd0a3fb80e

                                                                                                                                            SHA256

                                                                                                                                            88dc4b93c7d5f2e66d386f480ccf1a3035c78f5471a7562ca8f8c8032bb6bd7d

                                                                                                                                            SHA512

                                                                                                                                            2db6faedc0d7f01a3f2f1bfa8de6b5ad7b6f3ac09fb9249e589a69f384836462a5ead87e06554251310dcc86c99e7eef3fb947cb289ddbb17aa18a44b3c9da9f

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            5a5e552c69dcf2fffd1679990776a5f1

                                                                                                                                            SHA1

                                                                                                                                            a9744e04076db80a7c2fa2357c63a6a244b15b83

                                                                                                                                            SHA256

                                                                                                                                            ed93770450a692eb706e96ee0b3a815d4fce4d57b9ad511b8da25f7d7b811c22

                                                                                                                                            SHA512

                                                                                                                                            386a00d5e6e88a6cd686f5b94de5ce270f6454067188b848075f277c1949a9624b910d3659670a3df2effc25adeccf92276242ab21ddcb8e1fe0bbdd328197fd

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            02b8ee5ba5f2e1acf1eca3c4bfe01ae1

                                                                                                                                            SHA1

                                                                                                                                            5a89d85024b500b9a514df2793244cb813a5c089

                                                                                                                                            SHA256

                                                                                                                                            192cea2a64556e339ee92de009e0ccd7df98f515034965fa4ac8ddb535ccad2c

                                                                                                                                            SHA512

                                                                                                                                            88900879487ef310f1836fbe4a5805dcec37bbab711c9b4141e6f601b086420f952b88fefa83a7a21ee26645642c6215152b4a6faa20e4877e4ecc8f324f1746

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            12KB

                                                                                                                                            MD5

                                                                                                                                            0e740389960bdfcf57a38aec9679a69e

                                                                                                                                            SHA1

                                                                                                                                            c71eb75640a90ecd3a65ad7672d6329d92099411

                                                                                                                                            SHA256

                                                                                                                                            b0d42a278af0a47a6e143a41345a23deb5249b2bca15fbb8478cfefda0aa8562

                                                                                                                                            SHA512

                                                                                                                                            35a70135d4f37c21e28f096b0e99391d5433270f4f2d764cde86e5698d92ebb29aeece33400d5d8622180b6542deff0ed1a25df1c7adb1ae5e8241cbac6459ad

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            d9a3da50173b58b22f0344bb898dc620

                                                                                                                                            SHA1

                                                                                                                                            c6b5d8084d320460dd44388bd520ac3057e4bc3a

                                                                                                                                            SHA256

                                                                                                                                            8db48879fb0dbae15d00c1d6b56c9d7bac25476fde1a69f29a71be16aa693e7b

                                                                                                                                            SHA512

                                                                                                                                            63f37464acab8e7ac3d75b8caf264e87ff2fd525fabae2652a211f1ba6f288c6e04adc0afa00424b88a81a8dda2b0a01e38654e6a8c375c949c6ca44aa2bcafe

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            24d0794d3db46f3c51900ba626045094

                                                                                                                                            SHA1

                                                                                                                                            dd03f2ec984346c251dd7c6beaf728476813b4d8

                                                                                                                                            SHA256

                                                                                                                                            c716144cdfa69735fb167a051258ddadaa0f0bc359101910e1e57814a3496014

                                                                                                                                            SHA512

                                                                                                                                            9434e08ffd175e73b75960b7de1aa893741d75e45c33cd4ba4b955c8077d5e84d5970becd1dd01ae42a50fb5a99c539fd1271c78e289da4ee20fd34c857f6f09

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            6f281d3a03f1e9305b717e12db881400

                                                                                                                                            SHA1

                                                                                                                                            6c2c0a46a9777401c127db8ca17a295fd4e5dfd4

                                                                                                                                            SHA256

                                                                                                                                            8c4457462deabd11d4cf7a72369d3cab4f847e5b711557a507646b33990c6fff

                                                                                                                                            SHA512

                                                                                                                                            736e7f080baad54df44cc84e50bf9b4ff74f180c1b9b0e158d68ce4bd0f757c1d5f67db47680a9f08b19d8f4bdeabfbcd8a5a06b8b5a54294faad8d9e1cccb33

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9675762-4b2d-4730-b832-acf0e9083207.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            147e9ae8201652292378e8ed12514a14

                                                                                                                                            SHA1

                                                                                                                                            330dbe7d38a7e8fb60f478986413b9d81a93c05b

                                                                                                                                            SHA256

                                                                                                                                            83db69c171d824b04fa744d6d7ca8252f5e9f545183399be40d68addffbe3f97

                                                                                                                                            SHA512

                                                                                                                                            6f494c73a387c0b6b6c52511736a4791a07159b7e7c6d2d8366900ddc08cf1e6a7aa45da2bf6cd886658a07a2ba8adb57503418373c5fe659fe3376999634947

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ece08a2c-909b-42a4-9619-2af0d4fff1e5.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            7459f8c132feeda1119abd7bb805bc3c

                                                                                                                                            SHA1

                                                                                                                                            3d110469dfc3485206bd3e57253a86e4ae8a1e31

                                                                                                                                            SHA256

                                                                                                                                            c3c5009666f059dd761f00bf283bbfd7c832f805dde26775d5f2977a0727f9e9

                                                                                                                                            SHA512

                                                                                                                                            93201a0c2e61cb451b21cf9ea5d340415f76b63d13c36c3369f6737fc21aa6107aca8d8092f9f2d91c8a47e61fa002dfdeaa7040bf71d0840460aecb907a81e3

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee6271c3-d421-439d-ac8a-93853f303a71.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            b2080d7ce850045a75f0fd8d93d82758

                                                                                                                                            SHA1

                                                                                                                                            533a34ac4a1c74b0270f2876ae925c2e1adf8d2c

                                                                                                                                            SHA256

                                                                                                                                            e0d20a60bb87a59d783bd301e3d7762f24393dcccb81c3af375737d771bc6ee6

                                                                                                                                            SHA512

                                                                                                                                            9080ec6c9956647c4763941d88759c03127019f2d41d1bce97c936afb6d2df3f28a8940d73221bc16a97e4883e0bc518455e8120e239aef8fd069a814dc39a87

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef77a6cd-1c66-4f1c-ad0e-d5bb2bf7ecd9.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            f6ee5efb57b71566357d52d106caf215

                                                                                                                                            SHA1

                                                                                                                                            d05b9b690e71552b55758ddce629a6849456a77d

                                                                                                                                            SHA256

                                                                                                                                            800a2a0857af40a183b80d759f5c49cd97a5ad036072e5daf300515604b4cac6

                                                                                                                                            SHA512

                                                                                                                                            0f482d5532278fb9f9636e0b289f90d86b42308aa2491368470b5ffc039c40f4fcfa75f5b65dd50752f792eac09be99eb8f6c58819304d5eb56845063b477096

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                            Filesize

                                                                                                                                            512KB

                                                                                                                                            MD5

                                                                                                                                            cce61c1ece398cb8c0354e2375f36002

                                                                                                                                            SHA1

                                                                                                                                            e8536625266a75d3c2d632346ded77f6e2188bdf

                                                                                                                                            SHA256

                                                                                                                                            baf5260412a3ad620bb50edd5e35dc682b1442a691f66dd498c47250d28670e0

                                                                                                                                            SHA512

                                                                                                                                            04d139cc553da0865cf885ec4fa1afa9cb22448b49ab30592aed96ae53214842399e9991577af85e93c779382c47ed1ec7ca38531410f731a5bb9694633f6f7d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6lt1Zt1.exe

                                                                                                                                            Filesize

                                                                                                                                            898KB

                                                                                                                                            MD5

                                                                                                                                            4493c3520651693ca0471767fd37f20f

                                                                                                                                            SHA1

                                                                                                                                            3c3d491b1c6fcc07edf577cad22881910cf441d0

                                                                                                                                            SHA256

                                                                                                                                            eafa77494da616f73dcd8f49eed5d044a1880decfff1206fb58cc7e2983613f0

                                                                                                                                            SHA512

                                                                                                                                            ea1ece7c38ddeae5e93e2455b50cfd08d622f6cd99000855a90d2192fcede5ede71f1750b9c63d5ec86afecc3591beab3f91c26a192202441af222dc8c8d3c53

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XO0UY05.exe

                                                                                                                                            Filesize

                                                                                                                                            789KB

                                                                                                                                            MD5

                                                                                                                                            b62cbe2a191fee2243c8c28150ec777f

                                                                                                                                            SHA1

                                                                                                                                            3992584fb9c29fc84f41f35ebca4bec27014c708

                                                                                                                                            SHA256

                                                                                                                                            cdd43a1c420208cb24f8d8f45647107984ad55474db55fe0eee4a70c1deee718

                                                                                                                                            SHA512

                                                                                                                                            41b3062daf23f531ac69038086c7678157da5a8f3a10db410ea9c177e8c586c36a28e55a889ce7af829f8ac171190bd4f3f0229a2f3f45e6608ff4da7ea256c8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1VN46DW0.exe

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            MD5

                                                                                                                                            9b10f741fad1d0dd09b89dc6638833ae

                                                                                                                                            SHA1

                                                                                                                                            1f0ffa6f136cd5433f202c9c79ce5956796b4151

                                                                                                                                            SHA256

                                                                                                                                            1b69a1dd5961241b926605f0a015fa17149c3b2759fb077a30a22d4ddcc273f6

                                                                                                                                            SHA512

                                                                                                                                            4c83e0b137338a8685481623e592d10039ff15032f059b1e200f8e6a7810978e2eb5047604d12c31923761a0e46146c01fcabc871b8748b61a546bd1a32891f7

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4uZ060Ph.exe

                                                                                                                                            Filesize

                                                                                                                                            37KB

                                                                                                                                            MD5

                                                                                                                                            8837a89b82d0d3b0259cc9f47b2e599b

                                                                                                                                            SHA1

                                                                                                                                            51dd86a6a717a8f1470fff7a65f96c983aa71f09

                                                                                                                                            SHA256

                                                                                                                                            ad5c98936429f847e6808a4efdb80faf452a5c5c31d91f9f7de2560e51478701

                                                                                                                                            SHA512

                                                                                                                                            4a6c660c78bc99916d68978243f1140203a5805a3a7ae7a1749c609bd5aaf06b9ac253c09c0a206acdb832b45bc1ab700a5beb98024131779a45c70b53c7bc71

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                            Filesize

                                                                                                                                            2.3MB

                                                                                                                                            MD5

                                                                                                                                            77471d919a5e2151fb49f37c315af514

                                                                                                                                            SHA1

                                                                                                                                            0687047ed80aa348bdc1657731f21181995b654c

                                                                                                                                            SHA256

                                                                                                                                            52666594a3e8bd7ac277411e215e1f65a7771f7c1d5b00a9e6ec95fade64f1f1

                                                                                                                                            SHA512

                                                                                                                                            6ffb45e79b03bac2820c98503793cd11c13803f49522eea9334c4c6cd05384dda3a60b0a8a8f363abc439ad444f1a8da290f0350fa69b75b6c3c9701177f8844

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            MD5

                                                                                                                                            a878fd59450cb9ce6035866d1ead5046

                                                                                                                                            SHA1

                                                                                                                                            a27f49fe6077d9df7fc5876ee8e7411778b352b0

                                                                                                                                            SHA256

                                                                                                                                            adb7a719392c662a71ebc34d010e81dce9098b20982296800e91d1b586e71ef4

                                                                                                                                            SHA512

                                                                                                                                            bf6d19547349c02717856693c51eba0598d226abc925a1fc1c62b3b69d782dd3e18d30813f73a74c6b40ea4370e8c23757e830132e66f8689df479e60cce6d24

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                            Filesize

                                                                                                                                            291KB

                                                                                                                                            MD5

                                                                                                                                            cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                                            SHA1

                                                                                                                                            942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                                            SHA256

                                                                                                                                            0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                                            SHA512

                                                                                                                                            c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                            Filesize

                                                                                                                                            832KB

                                                                                                                                            MD5

                                                                                                                                            eee83ab5d14af0bebd96c000bd854a1b

                                                                                                                                            SHA1

                                                                                                                                            5f50f718aa6d29039376111bbd3cd4eb9d13164c

                                                                                                                                            SHA256

                                                                                                                                            dc22c20c08db192c155a83d6ebf99d9b95f5d513162f568cf1b0a9ac93123592

                                                                                                                                            SHA512

                                                                                                                                            33d555dcc1ae5de35bb9464cf55cc55e6cf44d3047e0ad3d614e84b85e5b2daaad52387a08582a77f71cb4351a4d4a08e7c32e485ba1b244536ada415a7b7bf5

                                                                                                                                          • memory/320-17-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            44KB

                                                                                                                                          • memory/320-20-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            44KB

                                                                                                                                          • memory/3108-975-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            80KB

                                                                                                                                          • memory/3340-18-0x0000000000B30000-0x0000000000B46000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            88KB

                                                                                                                                          • memory/3600-916-0x00000000075F0000-0x0000000007B94000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.6MB

                                                                                                                                          • memory/3600-914-0x0000000000390000-0x00000000003CC000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            240KB

                                                                                                                                          • memory/3600-961-0x00000000073D0000-0x00000000073E2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                          • memory/3600-1160-0x0000000007D20000-0x0000000007D86000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            408KB

                                                                                                                                          • memory/3600-951-0x00000000081C0000-0x00000000087D8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            6.1MB

                                                                                                                                          • memory/3600-969-0x0000000007430000-0x000000000746C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            240KB

                                                                                                                                          • memory/3600-972-0x0000000007470000-0x00000000074BC000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            304KB

                                                                                                                                          • memory/3600-923-0x00000000072F0000-0x00000000072FA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            40KB

                                                                                                                                          • memory/3600-922-0x0000000007350000-0x0000000007360000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                          • memory/3600-917-0x0000000007140000-0x00000000071D2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            584KB

                                                                                                                                          • memory/3600-912-0x0000000074C40000-0x00000000753F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/3600-958-0x0000000007BA0000-0x0000000007CAA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                          • memory/3796-1134-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/3796-1135-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/3796-1147-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/7348-915-0x0000000000DE0000-0x0000000002296000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            20.7MB

                                                                                                                                          • memory/7348-994-0x0000000074C40000-0x00000000753F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/7348-911-0x0000000074C40000-0x00000000753F0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/7844-970-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                          • memory/8208-1158-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/8208-1159-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/9000-1007-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB