Analysis

  • max time kernel
    124s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2023 12:56

General

  • Target

    82afcec5a81599040014a1ee0e318aa9a5dd80929cabfa436bede98c3fac9eb4.exe

  • Size

    1.2MB

  • MD5

    3713560a8905b160df73cb410fb8e8a5

  • SHA1

    15efb114c96da769f3482c6f0e69daac0c68e806

  • SHA256

    82afcec5a81599040014a1ee0e318aa9a5dd80929cabfa436bede98c3fac9eb4

  • SHA512

    9e08e069aa275b56a4a80aa977060e6a56f0ae58c973f52ffca7385dac760e9ef4be7d4202958e4df510b53bf24541549f9ae061b6a86c33d40b7567a867a7d1

  • SSDEEP

    24576:4yBovZNHd45DmxuC5gWj12zKLhFcyXpdf1AC7iArI5pXMys2D3:/BoxNH0DkuWj12zKLP3tcArWdxD

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 2 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82afcec5a81599040014a1ee0e318aa9a5dd80929cabfa436bede98c3fac9eb4.exe
    "C:\Users\Admin\AppData\Local\Temp\82afcec5a81599040014a1ee0e318aa9a5dd80929cabfa436bede98c3fac9eb4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hu1EL54.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hu1EL54.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mu89CS8.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mu89CS8.exe
        3⤵
        • Executes dropped EXE
        PID:3448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 608
          4⤵
          • Program crash
          PID:4368
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ga327iZ.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ga327iZ.exe
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:1672
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Wu4Rr9.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Wu4Rr9.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
          4⤵
            PID:4892
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
            4⤵
              PID:6160
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
              4⤵
                PID:6312
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
                4⤵
                  PID:6480
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                  4⤵
                    PID:6636
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                    4⤵
                      PID:6820
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
                      4⤵
                        PID:8128
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
                        4⤵
                          PID:7344
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
                          4⤵
                            PID:7912
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
                            4⤵
                              PID:8012
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                              4⤵
                                PID:8160
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                                4⤵
                                  PID:7268
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                                  4⤵
                                    PID:8264
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                                    4⤵
                                      PID:8340
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                                      4⤵
                                        PID:8428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
                                        4⤵
                                          PID:8816
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
                                          4⤵
                                            PID:9140
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
                                            4⤵
                                              PID:8656
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
                                              4⤵
                                                PID:8648
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
                                                4⤵
                                                  PID:8832
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
                                                  4⤵
                                                    PID:6728
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8272 /prefetch:8
                                                    4⤵
                                                      PID:8916
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8272 /prefetch:8
                                                      4⤵
                                                        PID:8936
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
                                                        4⤵
                                                          PID:6868
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:1
                                                          4⤵
                                                            PID:8652
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,10770623949227538867,3131698757024534964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
                                                            4⤵
                                                              PID:2404
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3424
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                              4⤵
                                                                PID:2008
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5562043299616929285,7685515518100844832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                                                4⤵
                                                                  PID:6660
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5562043299616929285,7685515518100844832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                                                  4⤵
                                                                    PID:6576
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                  3⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4268
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                    4⤵
                                                                      PID:1616
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17181302217812899892,17680883048534150988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                                                                      4⤵
                                                                        PID:6272
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17181302217812899892,17680883048534150988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                                                        4⤵
                                                                          PID:6264
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                        3⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3112
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                          4⤵
                                                                            PID:3968
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5797929914815292936,11446776043665197123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                            4⤵
                                                                              PID:6248
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5797929914815292936,11446776043665197123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                                                                              4⤵
                                                                                PID:6592
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                              3⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3256
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x78,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                4⤵
                                                                                  PID:4672
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,18257746240761174365,9204281055585725505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
                                                                                  4⤵
                                                                                    PID:6600
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,18257746240761174365,9204281055585725505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
                                                                                    4⤵
                                                                                      PID:6584
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                                    3⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:916
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                      4⤵
                                                                                        PID:1280
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6600659436957619777,3009707246482279869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                                                                                        4⤵
                                                                                          PID:6280
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6600659436957619777,3009707246482279869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                                          4⤵
                                                                                            PID:6256
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                          3⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3892
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x120,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                            4⤵
                                                                                              PID:724
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1749323610896771160,9539404032506907124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                              4⤵
                                                                                                PID:6540
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1749323610896771160,9539404032506907124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                                                                                                4⤵
                                                                                                  PID:6532
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                                3⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:384
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                                  4⤵
                                                                                                    PID:2536
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2378916123560829770,573786442767087125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                                                                                                    4⤵
                                                                                                      PID:6404
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2378916123560829770,573786442767087125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
                                                                                                      4⤵
                                                                                                        PID:6396
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                                      3⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1912
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                                        4⤵
                                                                                                          PID:3236
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,16353339118169200684,16805055824084058495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                                          4⤵
                                                                                                            PID:6296
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,16353339118169200684,16805055824084058495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:6524
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                                            3⤵
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4244
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffae9cb46f8,0x7ffae9cb4708,0x7ffae9cb4718
                                                                                                              4⤵
                                                                                                                PID:5052
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16079062353260231797,8117329883570427081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
                                                                                                                4⤵
                                                                                                                  PID:7504
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3448 -ip 3448
                                                                                                            1⤵
                                                                                                              PID:2008
                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:7632
                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:7260
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\67E8.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\67E8.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:9148
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\450A.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\450A.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:8032
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                                    2⤵
                                                                                                                      PID:6856
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                                        3⤵
                                                                                                                          PID:2868
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                        2⤵
                                                                                                                          PID:6004
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                                            3⤵
                                                                                                                              PID:2860
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                                            2⤵
                                                                                                                              PID:6656
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                              2⤵
                                                                                                                                PID:2608
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-STLAM.tmp\tuc3.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-STLAM.tmp\tuc3.tmp" /SL5="$302CE,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:1916
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                                      4⤵
                                                                                                                                        PID:7084
                                                                                                                                      • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                        "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                                        4⤵
                                                                                                                                          PID:7064
                                                                                                                                        • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                                          "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                                          4⤵
                                                                                                                                            PID:9108
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                                            4⤵
                                                                                                                                              PID:7764
                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                C:\Windows\system32\net1 helpmsg 1
                                                                                                                                                5⤵
                                                                                                                                                  PID:224
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:6576
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\55C4.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\55C4.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5500

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2a3b0967-6362-47bd-9683-7c2266b60643.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            8b1f276d569239d02963009a17813ab0

                                                                                                                                            SHA1

                                                                                                                                            d3b3db24f04db7aff21c197815107e567859b7da

                                                                                                                                            SHA256

                                                                                                                                            d5b8de442e9c9fa66af8a59bec5fc78f0c29b826919fe61d7b584fc1ffe43d9a

                                                                                                                                            SHA512

                                                                                                                                            dfea317e12789e26d22db9f4d56d551c8b2437321fe705c21fd5bb54e779ca3d8b76924e4e39781c04a91c715a73f42d33b3d62de3f1cb2731cdc0ef7d85e45c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77b77b80-4e7a-4679-90ab-e8e019012455.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            af2bda2d19946cdc38103fd647e68359

                                                                                                                                            SHA1

                                                                                                                                            26da1c948b6fa6b839209f8b29ccc110eeb795ed

                                                                                                                                            SHA256

                                                                                                                                            47eb4e31ffbacff326326457930d38f167ed252af8b28e8db60e324fd0527eb1

                                                                                                                                            SHA512

                                                                                                                                            82a1a9a724c7ffdca3c771f2ae02e891389646aecda9f124d3be85e5a8f06dfcb71c81c4a48c712bbb50dfcd2717cd4137c763814e21302e76a45b93dad1a0ab

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f3a0669-97fb-410e-99d7-08d8da06b110.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            52f2da1bf7bf03f927588c765aa9413b

                                                                                                                                            SHA1

                                                                                                                                            3a6a30762a76674513191c5835b5117ba218fe94

                                                                                                                                            SHA256

                                                                                                                                            250d7ebbccf99900937d41dde0d58fa4a35b8a22024ca1f9a5ba740d1fec5b20

                                                                                                                                            SHA512

                                                                                                                                            e31a1fe284c79db4c2cfea4d11f3d0deed4dce9360c33337aacdda73a731690bf4eceadc2756a819e55e633ad5f64989a4ce06728a91fddc68ae117f77eff885

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            5990c020b2d5158c9e2f12f42d296465

                                                                                                                                            SHA1

                                                                                                                                            dcb52612d301824d3a7fdfd0ea20c3fcfbb7a1b4

                                                                                                                                            SHA256

                                                                                                                                            2f33956ce5a0bb01abb3c0fee9a321c8f8f7abcf1d7535800bf25f1dc44b1643

                                                                                                                                            SHA512

                                                                                                                                            9efb70c4922365967c5fa7e89967e21eede96979a149e027099da786cd8b198d4e81bb3bf2b39c8d65a8796c5d72ca79241e66fc69e2502fdec8a0c5f230412c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                            Filesize

                                                                                                                                            152B

                                                                                                                                            MD5

                                                                                                                                            208a234643c411e1b919e904ee20115e

                                                                                                                                            SHA1

                                                                                                                                            400b6e6860953f981bfe4716c345b797ed5b2b5b

                                                                                                                                            SHA256

                                                                                                                                            af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

                                                                                                                                            SHA512

                                                                                                                                            2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                                                            Filesize

                                                                                                                                            21KB

                                                                                                                                            MD5

                                                                                                                                            7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                                            SHA1

                                                                                                                                            68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                                            SHA256

                                                                                                                                            6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                                            SHA512

                                                                                                                                            cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                                                            Filesize

                                                                                                                                            20KB

                                                                                                                                            MD5

                                                                                                                                            923a543cc619ea568f91b723d9fb1ef0

                                                                                                                                            SHA1

                                                                                                                                            6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                                            SHA256

                                                                                                                                            bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                                            SHA512

                                                                                                                                            a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                                                            Filesize

                                                                                                                                            33KB

                                                                                                                                            MD5

                                                                                                                                            909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                                            SHA1

                                                                                                                                            feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                                            SHA256

                                                                                                                                            dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                                            SHA512

                                                                                                                                            b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                                                            Filesize

                                                                                                                                            190KB

                                                                                                                                            MD5

                                                                                                                                            d55250dc737ef207ba326220fff903d1

                                                                                                                                            SHA1

                                                                                                                                            cbdc4af13a2ca8219d5c0b13d2c091a4234347c6

                                                                                                                                            SHA256

                                                                                                                                            d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd

                                                                                                                                            SHA512

                                                                                                                                            13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

                                                                                                                                            Filesize

                                                                                                                                            200KB

                                                                                                                                            MD5

                                                                                                                                            b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                                            SHA1

                                                                                                                                            19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                                            SHA256

                                                                                                                                            8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                                            SHA512

                                                                                                                                            86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            111B

                                                                                                                                            MD5

                                                                                                                                            285252a2f6327d41eab203dc2f402c67

                                                                                                                                            SHA1

                                                                                                                                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                            SHA256

                                                                                                                                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                            SHA512

                                                                                                                                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            27e75ee135b1036bf7ae5e015df3c8c1

                                                                                                                                            SHA1

                                                                                                                                            98e6c6a9c8b4e8cb511af918c6ae182593be746c

                                                                                                                                            SHA256

                                                                                                                                            aa1d7aaca0001bd40666d584713255f0e992678a429f7804ea191e33a91ad94a

                                                                                                                                            SHA512

                                                                                                                                            c92a2a62774d16153150bd2ab917b22d5d0a2bc52667eaa8b9b9ee69c424577814f93ca6539e5ae707a7a6a9c58db5ab086ee0974125e30164d32b1e42e3bdd6

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            5KB

                                                                                                                                            MD5

                                                                                                                                            2b12bf8051ad2a27a2895e7191bd25ce

                                                                                                                                            SHA1

                                                                                                                                            47493dbfbff51fa4c4d437a077cf1c7a94ada168

                                                                                                                                            SHA256

                                                                                                                                            a6853cf4b7ad84b7049bef0d5a501d318cb853b8249d60cbf3afcac60e520905

                                                                                                                                            SHA512

                                                                                                                                            97398d5c71863e2a143955b853ee87ebecef9444251dc54dc628c47d5ceac808f75f542f1ef7734f4ea232de3b4c8651a3a4b2cda2b6ef1041977aa28f00aaad

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            7c68993142e6f55b9b22975be6a6d0cb

                                                                                                                                            SHA1

                                                                                                                                            042bcbaf33273bbcab2510313702aebe01c94b34

                                                                                                                                            SHA256

                                                                                                                                            e0224e3b2e52f08413be17407a8f689109a4b3fea28050049daf92f35cf63944

                                                                                                                                            SHA512

                                                                                                                                            acecb17860cbbcd0a7249ef8367325431c159dc688000af9c0c41d412090e54fd4551fa230689adaa81352616c4a4aa31c0733c74f689aad34e25705b597593b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            MD5

                                                                                                                                            718eac4cbc565eb95b462d435cf9589c

                                                                                                                                            SHA1

                                                                                                                                            0e9dedd56d2a134d408e396d90a90721913c6110

                                                                                                                                            SHA256

                                                                                                                                            c3c7711bebd913b6931133e7f11defba343aa4c67c7e43502660ddad795ba28d

                                                                                                                                            SHA512

                                                                                                                                            e02a289b70a46035a5871d73e8a4cfd03fb7134416005c3d236d429de354ad3fde472a8349b4ad0b12185841bc75814dee821404421f809309c9ad8ee08cb347

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                            Filesize

                                                                                                                                            24KB

                                                                                                                                            MD5

                                                                                                                                            5a6206a3489650bf4a9c3ce44a428126

                                                                                                                                            SHA1

                                                                                                                                            3137a909ef8b098687ec536c57caa1bacc77224b

                                                                                                                                            SHA256

                                                                                                                                            0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

                                                                                                                                            SHA512

                                                                                                                                            980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            08299539c2d5ef3cefdd26155c25ab3c

                                                                                                                                            SHA1

                                                                                                                                            21b722c2c4869128d81a1e90a26d629b1a05ae3c

                                                                                                                                            SHA256

                                                                                                                                            7c2a7c743e8bc412e40f64f045c78ad5d90911f181f5fea918e974733bc8bf45

                                                                                                                                            SHA512

                                                                                                                                            ebdd5ae3574662dfef1e54a9707150a254f7b2a651bba3fcad2df0928e1de0ecbed0c782b9729d439ff6cd48a051772325268d3f4b9827a2d2afd95d67ee2815

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            a1fb30be51dffd3803eb332ba5ff5c08

                                                                                                                                            SHA1

                                                                                                                                            0b4ad861d882f83176c17a6e6903c93d7d5f2bf8

                                                                                                                                            SHA256

                                                                                                                                            3ef36b92822f8b98142999c8ed000820d468f92a2b1ade7377b7dd290c50d759

                                                                                                                                            SHA512

                                                                                                                                            c98f6cb5cc58986ddfc120ad520856d9f785d9760e43b874879a8dd61d40510390d55862ecdff3ba6b4b50a0761156abcba9d58fdff8567d02e662a28975f6d7

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            1ac8c4cf7c80e736411c496c0cf37990

                                                                                                                                            SHA1

                                                                                                                                            007650fb823dfe7b845f80468f478e30b00038ce

                                                                                                                                            SHA256

                                                                                                                                            7a1ca62274ab66557536989928a42b93b3ab94f6aed9de1e16a7f88fc9316da1

                                                                                                                                            SHA512

                                                                                                                                            ab54d4f82219c37406c56107971e399cba4d6be2d83f3671f6d2e419e107f335eb1126dce9aa40da2acaedea26ae9ba9297813d7f9095ad2ec4b58bd48f6e91a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            2b94415824f0bb57650eb40d6b63c692

                                                                                                                                            SHA1

                                                                                                                                            08aa177388cb46cf39b1868bba41dc3b624dfb5a

                                                                                                                                            SHA256

                                                                                                                                            72bb84f675fcc011303f77dcfba2b55513ea3251c6a182f501cadc989e740edd

                                                                                                                                            SHA512

                                                                                                                                            ad8307af245fb19397408c9749f765c8723a57f644f90be36cdc16dea4e2ea8cceb6908e6be9b10d1539b7bf8bcf1151c56e685ae1d02db80846cf18fd105440

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            655eca7be04dceca62d574d47cfda021

                                                                                                                                            SHA1

                                                                                                                                            a2c4d028b0614be1e1019ab462c1dee00a6f672e

                                                                                                                                            SHA256

                                                                                                                                            0dba3dddee84edf3a1b387828687b4820f8bca96f1ffa1140744b8c4580ef857

                                                                                                                                            SHA512

                                                                                                                                            863778294662a9e5d749dc35308b2fbe4d0fb239747f23e6240576fd55f17a031b3d260a7c7e69e8e8d86c044c81f401ae1f58000d10cb7d7a7c85ef14159a77

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5993ab.TMP

                                                                                                                                            Filesize

                                                                                                                                            1KB

                                                                                                                                            MD5

                                                                                                                                            28bdd4496a0dd4bcf4b719931310ca80

                                                                                                                                            SHA1

                                                                                                                                            29781a85445ca271aba0611393bf65fbb7281bfb

                                                                                                                                            SHA256

                                                                                                                                            f9f17ecf04f6b20ff5e2a6ac7a4062b4e676223aa43066ca9993270bc8631396

                                                                                                                                            SHA512

                                                                                                                                            9dff3e1cbe2f42d551c6e89fc0d3f4adb7a9ee8657f512b24bbcb0aa20bdf67affb73f383a142e18023364c8038864c95b47bb15f5c5f789fd11c406df6fe37b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                            Filesize

                                                                                                                                            16B

                                                                                                                                            MD5

                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                            SHA1

                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                            SHA256

                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                            SHA512

                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            56552d9f71ca9536cb51491e729235d3

                                                                                                                                            SHA1

                                                                                                                                            04108818a8b6ff98b0138e3faf1eda945156afdf

                                                                                                                                            SHA256

                                                                                                                                            a23724271ff196d83115d20cd5e126be12c2210f76bda4a283e8b231b4aaf3ff

                                                                                                                                            SHA512

                                                                                                                                            29dd7086d2f1116c9e128555ae99238a758659426621fdb7ee9e3c012ab1cbc1698ad46bfe596102982c19ebf9a36dc2612caa53e7741fa96be1866bc6515742

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            f395f16397b2ef8869dbe969ac74460e

                                                                                                                                            SHA1

                                                                                                                                            a58bfda3fc1680857bdf1879d91fb80d7c15966d

                                                                                                                                            SHA256

                                                                                                                                            181bcea4a305a7ba4e8046c5b37e63edce598514ca357d9c523b26868c4dd839

                                                                                                                                            SHA512

                                                                                                                                            1ac0c6844527668727978612930166c790af6b1ee83c3b9053c08651984b0e571611ce0c51e84588e3c11ffb48e3e2c242b498bcb16025bdfff85effc145ef0b

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            448ddcc739d85d15af7e4478b11c7700

                                                                                                                                            SHA1

                                                                                                                                            3d6f2e638442febdae1edf9c39bb9488fc492dae

                                                                                                                                            SHA256

                                                                                                                                            90471b9ff61a5077974c97b08518ea11852b9f32102e8ed54d4d9dc43b800f0e

                                                                                                                                            SHA512

                                                                                                                                            769ea4ff93453b135a0b2d45e036def78faaa8639a0954c18dd6c966af8976b5e339a056b285753c2490d6594726b039d2bbbd75678a9214bb3e5c0d620ce47c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            7aae64e930100eda5a6efba9e67c2b84

                                                                                                                                            SHA1

                                                                                                                                            ebb6de2cc046ff6346301dd1bf8fa386ac22577e

                                                                                                                                            SHA256

                                                                                                                                            b224779a6cdddfb457e0286fdcb1065b3139d365917a3bd6391ebeae26c5b648

                                                                                                                                            SHA512

                                                                                                                                            49aaa8f145f5da34e5335bf82c3033e2a6896db5be5c0a0b24df74da0db4b89c169a9538c9e6daf880b19c178a75bf2461af8151fefa14f4e61e5cda6daf4b64

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            a39081a26c2bba82d76a6c7a033b4b79

                                                                                                                                            SHA1

                                                                                                                                            5fb828a5e62b380969881286857c262e0a8219d6

                                                                                                                                            SHA256

                                                                                                                                            adab5464c30bccce5aa1ccb07cf94267f5bee1f97900512df63e58103199398e

                                                                                                                                            SHA512

                                                                                                                                            dbcd8864059a1ae35522c593d418516a40b85a04019e19c95dad233d49966a778b68c48fc4251ce0869d05d318cf94d99f17dc8a2dca42949cb8152bccac03f4

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                            Filesize

                                                                                                                                            10KB

                                                                                                                                            MD5

                                                                                                                                            6a53605f2fea1f6810a5bc4b0d42295e

                                                                                                                                            SHA1

                                                                                                                                            5a4cedb05cecc0beeac8bb9565ea6e5f2e51f87c

                                                                                                                                            SHA256

                                                                                                                                            6fcca4c5a338158f1c8b4b77e836f117ec525fe799088231311068bc381a2822

                                                                                                                                            SHA512

                                                                                                                                            699abb0f940bfadba3d9e96f297c552afe1b7736bc83593f9016594c10c00529447e632962d40e052d4dd1caabe0951f972d1bca9ec3bde1fe6abbe0dbd0035a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec5439a7-4060-475e-8c77-40e24b16a0fa.tmp

                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            9daf721581280e79808c55250e23a953

                                                                                                                                            SHA1

                                                                                                                                            0778a181a276c7cac2e33499b26e77715d4a00ec

                                                                                                                                            SHA256

                                                                                                                                            966d9244f911917beac2556c2737ee1733d7b95022ec75d32a2655bce4341056

                                                                                                                                            SHA512

                                                                                                                                            f0d1d738de9c2fcb24a59137b05d8724a94969a3a1165f797ba60b9ae4300d38a2b027d7362bd1cf9aa3802c3ec878ddc263465ab3f32596ca61ceb66e5ec4bb

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                                            Filesize

                                                                                                                                            768KB

                                                                                                                                            MD5

                                                                                                                                            62a117accf1701d57d4d3b2e30daf6ff

                                                                                                                                            SHA1

                                                                                                                                            0ac915f51c25856b99d303aefcc516a06a8fae9c

                                                                                                                                            SHA256

                                                                                                                                            066c6c0b72add7e6ef1a9d0c1499fd91c9ef0a61e4aea41aedc70c253fa8569b

                                                                                                                                            SHA512

                                                                                                                                            7d05124016a176a9ed10fae15af24090598f2aa56444271462478decf6c682b18958ad07108e478e75bf23353392a633ae5e3ff86c7269884ecbfab3a7adb9c7

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Wu4Rr9.exe

                                                                                                                                            Filesize

                                                                                                                                            898KB

                                                                                                                                            MD5

                                                                                                                                            5efaa4f7183c4488230527239e8291af

                                                                                                                                            SHA1

                                                                                                                                            ee2a36e37a60991a867df6967fef224b31ed9dcc

                                                                                                                                            SHA256

                                                                                                                                            370185caf74c09be093480a6732e878861d0c891f4b3b9c6025a9b5ad2c3041d

                                                                                                                                            SHA512

                                                                                                                                            3390b66a2d6f017017d5c1668999252f254cc38159c1a9c7ef31ba8b397ad5424c1a2cc931d9c07b16114c35c0c232fcf65b0b70dbb4989680ad57c7db713015

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hu1EL54.exe

                                                                                                                                            Filesize

                                                                                                                                            789KB

                                                                                                                                            MD5

                                                                                                                                            9b2a77f3b221dd638b6d5238578ec49b

                                                                                                                                            SHA1

                                                                                                                                            7f39961dcf673ad87ec04dd06ba3eb02c8a7dde2

                                                                                                                                            SHA256

                                                                                                                                            4db49ebcddde4da6e25316edffc913af6b947e92400387ae6979a4d9f41fb003

                                                                                                                                            SHA512

                                                                                                                                            735c793f7fe203f4f99eeb168bf6e9c99f996a46e0eddebdb778d121469dea2a59203d4b5fec776a75bb8a321ca4a3e4b47faae7293e51305594326f5a1fe923

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mu89CS8.exe

                                                                                                                                            Filesize

                                                                                                                                            1.6MB

                                                                                                                                            MD5

                                                                                                                                            11af63b6362fc98c8cf1db657a482afc

                                                                                                                                            SHA1

                                                                                                                                            9eb180d2d7a1494493780584968e68352823e78d

                                                                                                                                            SHA256

                                                                                                                                            e4216411093bf019f191a00130b3d13da0e08bb386b98759dc639116d0c410d2

                                                                                                                                            SHA512

                                                                                                                                            5f1e0c8c68ed52adf84c94adf226e319c8c1df3a4b712dc15989670ca2f50cc33f6b064de27ad55c87d0e1357e8b1037210f0b9393a7a548fa93215fdff82015

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ga327iZ.exe

                                                                                                                                            Filesize

                                                                                                                                            38KB

                                                                                                                                            MD5

                                                                                                                                            a28247b86a7fbf1b9a56362f9bb67775

                                                                                                                                            SHA1

                                                                                                                                            731338fc79756cbeac7ec390daeca955d83ed317

                                                                                                                                            SHA256

                                                                                                                                            2f52b38b5cef8cf286877a07f99b25fe904f71be13f784fee571c8daf7767725

                                                                                                                                            SHA512

                                                                                                                                            15709d0385aaaea1412e0ab585c6f44fc6fba6fc7aff0e2032e0f14592a8a677fe9348be2a6d5b7a41070b18e23ee959daaa04700eb1484208121088d7b0477e

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                                            Filesize

                                                                                                                                            2.3MB

                                                                                                                                            MD5

                                                                                                                                            77471d919a5e2151fb49f37c315af514

                                                                                                                                            SHA1

                                                                                                                                            0687047ed80aa348bdc1657731f21181995b654c

                                                                                                                                            SHA256

                                                                                                                                            52666594a3e8bd7ac277411e215e1f65a7771f7c1d5b00a9e6ec95fade64f1f1

                                                                                                                                            SHA512

                                                                                                                                            6ffb45e79b03bac2820c98503793cd11c13803f49522eea9334c4c6cd05384dda3a60b0a8a8f363abc439ad444f1a8da290f0350fa69b75b6c3c9701177f8844

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                                            Filesize

                                                                                                                                            640KB

                                                                                                                                            MD5

                                                                                                                                            a1c4a4980ebfdc7e721ffaed87900dc5

                                                                                                                                            SHA1

                                                                                                                                            16a46aafc07c511af8b6da8973d2b78292de4378

                                                                                                                                            SHA256

                                                                                                                                            d5f1484ac14dfce241ffee57cc478f1fba084ebe7d43dbdb83371482551a58b9

                                                                                                                                            SHA512

                                                                                                                                            913d6122f1181419a68d5a2a35e7f4bb5a897ee41686ebe70b039e5b83e45ba239ccc1bffa3896edbb1757daca520f57a19a1ab7ff148dee605cdb0bfbe842fd

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                                            Filesize

                                                                                                                                            291KB

                                                                                                                                            MD5

                                                                                                                                            cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                                            SHA1

                                                                                                                                            942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                                            SHA256

                                                                                                                                            0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                                            SHA512

                                                                                                                                            c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                                            Filesize

                                                                                                                                            1.2MB

                                                                                                                                            MD5

                                                                                                                                            312dbad72fbc4a4a97c1c269e0ecae76

                                                                                                                                            SHA1

                                                                                                                                            1d5864b8eb96c1c4fd45667b0a0981643183fa10

                                                                                                                                            SHA256

                                                                                                                                            3afa784ee5c99abf77ca1e6037d2603f9ec187658e854d3ec509164ed858e01b

                                                                                                                                            SHA512

                                                                                                                                            9d2ae8933d0425ae0a71e502b378c2e958a2274f8ce97c40e07e6e9bf9353bc748e0665e9b6f5c7aba0426b180510d2c419616f0167b13ac56398fc88dd31d02

                                                                                                                                          • memory/1672-20-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            44KB

                                                                                                                                          • memory/1672-16-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            44KB

                                                                                                                                          • memory/1916-866-0x00000000020C0000-0x00000000020C1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                          • memory/2608-832-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            80KB

                                                                                                                                          • memory/2860-1028-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            36KB

                                                                                                                                          • memory/2860-1024-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            36KB

                                                                                                                                          • memory/2868-841-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                          • memory/3384-18-0x0000000003500000-0x0000000003516000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            88KB

                                                                                                                                          • memory/5500-740-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/5500-739-0x0000000000860000-0x000000000089C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            240KB

                                                                                                                                          • memory/5500-785-0x00000000077B0000-0x00000000077C0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                          • memory/5500-760-0x0000000007610000-0x00000000076A2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            584KB

                                                                                                                                          • memory/5500-1029-0x00000000077B0000-0x00000000077C0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                          • memory/5500-754-0x0000000007AD0000-0x0000000008074000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            5.6MB

                                                                                                                                          • memory/5500-867-0x00000000086A0000-0x0000000008CB8000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            6.1MB

                                                                                                                                          • memory/5500-868-0x0000000008080000-0x000000000818A000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                          • memory/5500-869-0x00000000078A0000-0x00000000078B2000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                          • memory/5500-870-0x0000000007900000-0x000000000793C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            240KB

                                                                                                                                          • memory/5500-920-0x0000000007960000-0x00000000079AC000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            304KB

                                                                                                                                          • memory/5500-822-0x00000000077D0000-0x00000000077DA000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            40KB

                                                                                                                                          • memory/5500-1021-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/6004-1027-0x00000000008F0000-0x00000000008F9000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            36KB

                                                                                                                                          • memory/6004-1026-0x0000000000AF8000-0x0000000000B0B000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            76KB

                                                                                                                                          • memory/6656-1023-0x0000000002DD0000-0x00000000036BB000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8.9MB

                                                                                                                                          • memory/6656-1025-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            9.1MB

                                                                                                                                          • memory/6656-1022-0x00000000029C0000-0x0000000002DC1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4.0MB

                                                                                                                                          • memory/7064-1005-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/7064-1003-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/7064-1007-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/8032-844-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/8032-736-0x0000000000B10000-0x0000000001FC6000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            20.7MB

                                                                                                                                          • memory/8032-735-0x0000000074A20000-0x00000000751D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            7.7MB

                                                                                                                                          • memory/9108-1011-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB

                                                                                                                                          • memory/9108-1009-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            3.5MB