Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2023 11:00

General

  • Target

    09e7ae08fdb0aa91946362c5a98b128d4c4c21ad5af8670aff8d40569e697a68.exe

  • Size

    1.5MB

  • MD5

    401a0fdfc8856195d73b3beb25767d40

  • SHA1

    a6bc66178ec9fd1e04c321bbb5fc8ccd08424a5c

  • SHA256

    09e7ae08fdb0aa91946362c5a98b128d4c4c21ad5af8670aff8d40569e697a68

  • SHA512

    161b9a888dda677fafc5272561b64d4033ac51cd9085c995c6d79c72abda4990ff7297bd690705d6bf13990fe1ed9f15c1459c636e815b8d9b17863f4728212a

  • SSDEEP

    24576:IylFb/tfZnV3vrc9hvLgYoFjGasG+kRWmtd/8BI4tnWiKnhK0bYdg+w/9cyu9Yf+:PlFb/tRnVQTvMYo1GrG+C/mn2BkymyuO

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09e7ae08fdb0aa91946362c5a98b128d4c4c21ad5af8670aff8d40569e697a68.exe
    "C:\Users\Admin\AppData\Local\Temp\09e7ae08fdb0aa91946362c5a98b128d4c4c21ad5af8670aff8d40569e697a68.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aj5aY88.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aj5aY88.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1GL53Km0.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1GL53Km0.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3964
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x13c,0x170,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
            5⤵
              PID:3656
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,954276045295799631,1968640166615613464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:6496
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:352
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
              5⤵
                PID:228
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4018551538538446894,1329169619806985276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                5⤵
                  PID:5836
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4018551538538446894,1329169619806985276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5844
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1916
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x144,0x170,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                  5⤵
                    PID:2000
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,12364705907164522947,18440596666134259808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5516
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12364705907164522947,18440596666134259808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
                    5⤵
                      PID:5508
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2756
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                      5⤵
                        PID:2128
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,15971239553710611927,9875901371367311455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
                        5⤵
                          PID:5360
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,15971239553710611927,9875901371367311455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5400
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4880
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                          5⤵
                            PID:1760
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10069694218196018358,13463391852990473076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5456
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10069694218196018358,13463391852990473076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
                            5⤵
                              PID:5448
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                            4⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:2700
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                              5⤵
                                PID:4616
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
                                5⤵
                                  PID:5712
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
                                  5⤵
                                    PID:5704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
                                    5⤵
                                      PID:5696
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                                      5⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5464
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                                      5⤵
                                        PID:5408
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                                        5⤵
                                          PID:5596
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
                                          5⤵
                                            PID:6812
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
                                            5⤵
                                              PID:7024
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
                                              5⤵
                                                PID:6284
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
                                                5⤵
                                                  PID:6228
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                                  5⤵
                                                    PID:7336
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
                                                    5⤵
                                                      PID:7492
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                                      5⤵
                                                        PID:7540
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                                                        5⤵
                                                          PID:7768
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                                                          5⤵
                                                            PID:8052
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                            5⤵
                                                              PID:8044
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5408 /prefetch:8
                                                              5⤵
                                                                PID:7440
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3044 /prefetch:8
                                                                5⤵
                                                                  PID:7200
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
                                                                  5⤵
                                                                    PID:6020
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                                                    5⤵
                                                                      PID:5940
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                                                                      5⤵
                                                                        PID:4748
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7892 /prefetch:8
                                                                        5⤵
                                                                          PID:6040
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7892 /prefetch:8
                                                                          5⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:6256
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
                                                                          5⤵
                                                                            PID:2228
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
                                                                            5⤵
                                                                              PID:5772
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:1
                                                                              5⤵
                                                                                PID:5628
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:1
                                                                                5⤵
                                                                                  PID:4760
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12536540948754650542,16414782805913212810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:2
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1380
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2268
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                                                                                  5⤵
                                                                                    PID:2544
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10058943174517141673,18181560110273439930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
                                                                                    5⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:6568
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  4⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1040
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                                                                                    5⤵
                                                                                      PID:4072
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,632077482624109663,7748710459910009159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                      5⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5888
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,632077482624109663,7748710459910009159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                                                                                      5⤵
                                                                                        PID:5876
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      4⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4808
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                                                                                        5⤵
                                                                                          PID:4268
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,298472321037033661,6309959845455330887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
                                                                                          5⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6520
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                        4⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1908
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd47bf46f8,0x7ffd47bf4708,0x7ffd47bf4718
                                                                                          5⤵
                                                                                            PID:2532
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2LE3638.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2LE3638.exe
                                                                                        3⤵
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        • Checks processor information in registry
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • outlook_office_path
                                                                                        • outlook_win_path
                                                                                        PID:4408
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                          4⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:6656
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                          4⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:8004
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1260
                                                                                          4⤵
                                                                                          • Program crash
                                                                                          PID:6716
                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7cP0lb53.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7cP0lb53.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:6380
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 1056
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:4892
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:6792
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:6544
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                        1⤵
                                                                                          PID:7304
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                          1⤵
                                                                                            PID:7312
                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                            C:\Windows\system32\AUDIODG.EXE 0x428 0x324
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4320
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:8012
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4408 -ip 4408
                                                                                              1⤵
                                                                                                PID:5184
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6380 -ip 6380
                                                                                                1⤵
                                                                                                  PID:7540

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d3eeefc-0cff-4c1d-a312-6bf94693a6c3.tmp

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  120a3e93ea1f1c7e4c538ce84a24b00b

                                                                                                  SHA1

                                                                                                  88f18816d99d83c4a37c7774aee18a87ce8dfb92

                                                                                                  SHA256

                                                                                                  cd92dbe0c8dce3e82d78eb34d27e0088838837bf74084ec7dd5d5e725964de8e

                                                                                                  SHA512

                                                                                                  563ef6c40524e18863d3f661a4f64d7a2aaec674eeb11b54db6cbbbc54d0f785ca1aa31b5c2a784d220a1e29dc235eb68922236273ee5cc599dd83b9e160388f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  d94c59e136e2bc795637c1c05e315e35

                                                                                                  SHA1

                                                                                                  0ec32d5c51c34e9215b5390e7aa4add173310f01

                                                                                                  SHA256

                                                                                                  ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

                                                                                                  SHA512

                                                                                                  57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  890585f0e978711e84e103f4e737e1b8

                                                                                                  SHA1

                                                                                                  12b9a7b4a1a016c8a0d4458f389135ed23574e27

                                                                                                  SHA256

                                                                                                  c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

                                                                                                  SHA512

                                                                                                  246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                  Filesize

                                                                                                  73KB

                                                                                                  MD5

                                                                                                  6dfb28a6390f63171f06e77ea2e7465a

                                                                                                  SHA1

                                                                                                  415dbb91566f810a83c3c6efa2e4dd2c4084c276

                                                                                                  SHA256

                                                                                                  3cfe4ed506d1ee431d75dfab4e2f1ada2fd30e8d7664061d9fd706b3ed9c4b98

                                                                                                  SHA512

                                                                                                  333b19faaa15c61ee44793bb4c2222663070ebf6463fb85115f561bba0abff09ab8a88f5dcad8f31ccc496b42930d137c865515c78ecb0a0adf994d64354ba56

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                                                  Filesize

                                                                                                  20KB

                                                                                                  MD5

                                                                                                  923a543cc619ea568f91b723d9fb1ef0

                                                                                                  SHA1

                                                                                                  6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                  SHA256

                                                                                                  bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                  SHA512

                                                                                                  a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                                  Filesize

                                                                                                  21KB

                                                                                                  MD5

                                                                                                  7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                  SHA1

                                                                                                  68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                  SHA256

                                                                                                  6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                  SHA512

                                                                                                  cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                  Filesize

                                                                                                  33KB

                                                                                                  MD5

                                                                                                  909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                  SHA1

                                                                                                  feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                  SHA256

                                                                                                  dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                  SHA512

                                                                                                  b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                                                  Filesize

                                                                                                  190KB

                                                                                                  MD5

                                                                                                  d55250dc737ef207ba326220fff903d1

                                                                                                  SHA1

                                                                                                  cbdc4af13a2ca8219d5c0b13d2c091a4234347c6

                                                                                                  SHA256

                                                                                                  d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd

                                                                                                  SHA512

                                                                                                  13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

                                                                                                  Filesize

                                                                                                  200KB

                                                                                                  MD5

                                                                                                  b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                  SHA1

                                                                                                  19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                  SHA256

                                                                                                  8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                  SHA512

                                                                                                  86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  366760b1a6dc43b7c38a9f03f3b973a3

                                                                                                  SHA1

                                                                                                  29ed57014e85177f546f3d82f818eb0dc3c92c9c

                                                                                                  SHA256

                                                                                                  c090663a1f2f703618b732a056343ab49d651e84f60acf7e48cf48584c69cfff

                                                                                                  SHA512

                                                                                                  6094c1b6fe99cf83b543f005b702f71754f79a7090062043ea535e88f2ee35762487e36323300104b9846daa04a940bbfce0f4ec9f7468a1f53c71dad8ef4097

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  111B

                                                                                                  MD5

                                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                                  SHA1

                                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                  SHA256

                                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                  SHA512

                                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  b0b5e7036817f6c8e3a3ede087777d0f

                                                                                                  SHA1

                                                                                                  39aa828918462f8ee5c1c8d005fcfae3067f821d

                                                                                                  SHA256

                                                                                                  9d227aa29fc775b08624c0869410fea8013422f532f0ad50ad9b15433188bc3b

                                                                                                  SHA512

                                                                                                  ddcd0c8cf13c275046032a4a6bf1c426c3dbe52d7a1241af21c9b4d6f383786043ad600f4ccf5b801b42f553f07550139780429b6a8ef48c1cd53a725a98eb2c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  6a7291823c43d0cfedcbe124036d532f

                                                                                                  SHA1

                                                                                                  1addcee6589b1101ba0e79889dc1a62f73c7041e

                                                                                                  SHA256

                                                                                                  29e30d52fb0a7dc580ed25f72bf34aab8e8f5289c3f64548532c22d25d14623f

                                                                                                  SHA512

                                                                                                  367507832f0c3284dc7007d79da3403d8caebea2004d8e6e652cd29be85f36ad7794b9281ad0cc49e68997cc67893e81ed964d4aca8890846bf80b59b39d6185

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  c8c41ba1df6a46756bfa9ab97feb28a3

                                                                                                  SHA1

                                                                                                  fd718c5a33782ff49cc633971a725b1187a90775

                                                                                                  SHA256

                                                                                                  2299b47027785b21a9bb10368d053344f1143f2557f863c55a67beeda352c67a

                                                                                                  SHA512

                                                                                                  5fd285112959858d17c71816fae49eef8c5875ce155aa1601773fb4e7714fbfc01af05af011901e4d3fd3342f191c4c66af873820b041d0a7c356b707ac80a39

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  5f300547a9c6ca975390d08d51a7f396

                                                                                                  SHA1

                                                                                                  358eebfb4ae5560c3703080096bebea07cf43ba8

                                                                                                  SHA256

                                                                                                  b9da86afd4f69c2c15d8e4da4da53042052ed11961450b452bac2898d2e65925

                                                                                                  SHA512

                                                                                                  f421c6cff77eae1200b00a6ad932a56218015c025425b85a09989af1e32b201ce6d9a1a4c11b9a42ba744c54810b6b38d9c91bd91ef870b0a4ac94de6e060814

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  6569d7e26b6ef9be1bf99226ead3af1d

                                                                                                  SHA1

                                                                                                  e53fd7812652c99e299c5a26b833cadd9872d035

                                                                                                  SHA256

                                                                                                  7ea8e3fc77ecebe8c18ab6be58821805eb544bdf4eb46207835ead6f0e7db125

                                                                                                  SHA512

                                                                                                  aaaaa10d86d74664fb1738e328b20161cc17a0c8c89ccb6711c386afa0aaf64e883f0138c8159f94505624b4d91d6c07971880a949f50883f1b225e608fe12a8

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  695a3dd97a23dc49006f38a5c658738d

                                                                                                  SHA1

                                                                                                  e30ca525c50649bd9dd595b7865673790d2389b0

                                                                                                  SHA256

                                                                                                  f46ea7000d0a91c261ae568d41ba7f1c679413c82af6b5a693e7adae1661ffcb

                                                                                                  SHA512

                                                                                                  905edc4bbdfdcca75f2c0aafdc087c35776c76a3d6e534435aec544dbafc827d838a12a4efba0dc678fb1c27b95ce0d22310d01c3af550f38d12210e3bc1a289

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  bbcec4df317b7a32c756438007360e8e

                                                                                                  SHA1

                                                                                                  0bacc81088f4f5e223a9cd2c35036e0e66e5d329

                                                                                                  SHA256

                                                                                                  b569bdc5ae5a689547c8858b6d1624d3c2bb3fb0a061923726d625d26db89260

                                                                                                  SHA512

                                                                                                  f7b454c399c7c2e692a99cae6bbd16c2722bb9d71b03f5d9a86836e9bfa42cc3d7d438f6b8e8f791c70fd5a74b1a1f5d591dc049f9b2d46ac4bf08c7c94f7089

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  MD5

                                                                                                  a553ed37741112dae933596a86226276

                                                                                                  SHA1

                                                                                                  74ab5b15036f657a40a159863fa901421e36d4fa

                                                                                                  SHA256

                                                                                                  ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

                                                                                                  SHA512

                                                                                                  25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d3d8999-8ede-4c9b-98bc-d572eae82d1a\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  c671e7838846d6547e7336e55e952889

                                                                                                  SHA1

                                                                                                  dadfb798156bce5454ce0ae1e56faf90bfe0ee01

                                                                                                  SHA256

                                                                                                  0aeca9b1e98eb85329a142db6bedf4bafa072d7716c9b7130a921bbc9b12f0fd

                                                                                                  SHA512

                                                                                                  e97cc4aa239bac4614192fc2439184c26ef29f4640dba66a66e335d7594631df9422005516798404833f94ac4755934f5e4f5fa61e18568fdbdc831b322e9819

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d3d8999-8ede-4c9b-98bc-d572eae82d1a\index-dir\the-real-index~RFe57fe26.TMP

                                                                                                  Filesize

                                                                                                  48B

                                                                                                  MD5

                                                                                                  1e58aee5088b119816446e4b53dacf1a

                                                                                                  SHA1

                                                                                                  6761ca58c4616ca9c11e2a03a86ff5fa6d6b6990

                                                                                                  SHA256

                                                                                                  ea82df901541c6ca234e1392305fd846f0cf32cf674bf0cffb050fa106c3eae9

                                                                                                  SHA512

                                                                                                  02fd1764223cc1f4dce78e700690b702e55a5d92699805584859d17038eb0536e85e89f4e79c35c5ee5b948dde8f23e5b67ed52da5040e43317d3cf127ba0b49

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  84B

                                                                                                  MD5

                                                                                                  4c9ec40cf9a57dc42baa071d89d7d5b2

                                                                                                  SHA1

                                                                                                  45845b2ce7445f6383e73eded4ccdd853daaa1b8

                                                                                                  SHA256

                                                                                                  2e1bd707af16d7e4f01746b01c532df805b687e45a04865006b768d90f2e8645

                                                                                                  SHA512

                                                                                                  9fa4b4c69e47468d5d1c47ebfd9e2ab34221aac91ad55b7725f7ef7d3030c1a77a7c893666526f9b8d3c8624f533a65004586a3fa8cb9b7ffc06831737086912

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  146B

                                                                                                  MD5

                                                                                                  feb7d7d5df6e6af652ca4764380bd506

                                                                                                  SHA1

                                                                                                  eedde68027751491812db46b4f97736275835f3a

                                                                                                  SHA256

                                                                                                  cb6c5f62898ec18a415eca1a3310c841543c883a1b71fcc3860b2a34a0964f6f

                                                                                                  SHA512

                                                                                                  848e91db0f845ef89f3b7ccb42a81c548f86306271bc5ee3144a67d6759b4ada4b81fe1680f2c4b2d073d82052384ce5a551145830e5d27cde98983d42788b4c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\b2fdfb85-5a49-40a6-9b05-103465534a53\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  9b7d2f676be3c46f7b9022a2fc2e45c4

                                                                                                  SHA1

                                                                                                  38aab60b4cfe9054a05c1a814c71d62fc28965f7

                                                                                                  SHA256

                                                                                                  cc62a18239a4d661228d6e15d4aa75767e639dbc39cff677d6b882f6bb8f61af

                                                                                                  SHA512

                                                                                                  dc597b9c893146ed9b82623a78fe37f3f37bcde3cf9681cbd947a781c4218e230d61da01de155325897dadc7c49e3e3a604a16dc0fd6b6f417119307b64087c3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\b2fdfb85-5a49-40a6-9b05-103465534a53\index-dir\the-real-index~RFe58a5a1.TMP

                                                                                                  Filesize

                                                                                                  48B

                                                                                                  MD5

                                                                                                  01bb0d0c7ef3a97e39b4fd9e6c377821

                                                                                                  SHA1

                                                                                                  fa0986b01ed5117f894347f0eea908692459cfc0

                                                                                                  SHA256

                                                                                                  058afda5f1234eddbdd62bf7e1888f21cbf635b7d62695ceba3aa4a377db7d55

                                                                                                  SHA512

                                                                                                  449df8a72bec432969f9c645386433829e705345c3af2629f85129a1828e3f9b9bee71f86a2750a3c25e3991a1f3e1acd98153c7e163378888e876897e4af6d8

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                  Filesize

                                                                                                  83B

                                                                                                  MD5

                                                                                                  c6fdca7a91a3e3419e63dcf2c493f34d

                                                                                                  SHA1

                                                                                                  12587abd0178d9cd3c4516554f1b65afe6198376

                                                                                                  SHA256

                                                                                                  11b6e134a6e6f3f556abf059be3a6a9856df96a49961ce701337d61b33ce899d

                                                                                                  SHA512

                                                                                                  37d0d73024250ed2838ddc8f040bfba5e448f29449a7dfb209e60f05790ef6d3b8c5514dbd0acc895c00b0196c05167c71834a13c1f7cafbc76756a046811f39

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                  Filesize

                                                                                                  79B

                                                                                                  MD5

                                                                                                  004e3be44309139311461c530fb7a85c

                                                                                                  SHA1

                                                                                                  0d9a5bb8ff43a519b45e9d35129af1765fff080d

                                                                                                  SHA256

                                                                                                  d2ddb22a14f92c8a4d01750856a6d41dc70c3abd6f86c6ea58c31eb8e2234399

                                                                                                  SHA512

                                                                                                  b3cd3ec7dd87942ec08285e68e1a20c9cd12882dc9538c533148b2824c96baec55bd7b3356791afe8d07eb4c5afed2d2bb14211bbdf5bc9930a5da855137d3b3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                  SHA1

                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                  SHA256

                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                  SHA512

                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  120B

                                                                                                  MD5

                                                                                                  8a2e9887f78c3e2619a345dd49beec7d

                                                                                                  SHA1

                                                                                                  663cd12c674875f102fc082cc6c67e54e408c750

                                                                                                  SHA256

                                                                                                  ef05f2f11165bd0f9cace5e3e0b144236ea14b5dcb920597f2d5787aee88a86d

                                                                                                  SHA512

                                                                                                  bc4f05606ba1a46eb7f8a71072b77f486d230df3f0e3b3f6a95933e8e6fa1f1db3a475d061424d7a9153e710209693488686dab1aa53f280e1099a41081161c9

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583e9a.TMP

                                                                                                  Filesize

                                                                                                  48B

                                                                                                  MD5

                                                                                                  21fdec8d07b93803de27d401a2c1c17f

                                                                                                  SHA1

                                                                                                  d00895b08ad67d51cf678d5c10ea87b21b860af2

                                                                                                  SHA256

                                                                                                  d6917288e35abad88038f8a04fee31bcb3252eddf76c910b8c9abb4ef92f21c4

                                                                                                  SHA512

                                                                                                  5fd66bbef809808b652e5ab764ead7c21ad389360b14b4f66aaea905cf32266155ea50731587778c3c6958831965e5acba03d4ef135f2152cf3c3ad330b81170

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  a30717fc272ac32a9ffbb4dfbe198dd4

                                                                                                  SHA1

                                                                                                  2b8b71df15e8f0fb6ef0a5ca074b8786a19f51c8

                                                                                                  SHA256

                                                                                                  2cdbf0bbf10e4b089c35c8b7aabc263d93077efeb05f2525a9737890f22c90c4

                                                                                                  SHA512

                                                                                                  53401df71ba7ea3384a02815a75a610f916dbf199f4d8ed2ce508be8d43ec83d301fc68f110f7c85d0a83f2e936fb54a4e3bf37ca7dc896a13dacc99e37b7272

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  3550d5c7608369cf9a717ddae63e85f7

                                                                                                  SHA1

                                                                                                  564bb290df32405f57bcc8bc194c247ad1066a58

                                                                                                  SHA256

                                                                                                  fd1039e32ba59b5e973cbc78d51c9173c938de15e29eeeb1be8bfe319d601d90

                                                                                                  SHA512

                                                                                                  67317e53e89c2e63edcfb9ef8b778d8a2affc70f5d065487f445b42de11602ca25ded2c572507832c642ac8e4b0d5177fa7bdc43dc09822038582c17560538dc

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  ae5c46d3acaa74067c97f8907a521a32

                                                                                                  SHA1

                                                                                                  8d87efad402fa2622f789c8044bee883c395012d

                                                                                                  SHA256

                                                                                                  c1c225cb4032bc5068eeb84f7b63df63590f33bd70fdbe0037d03b09eaaef248

                                                                                                  SHA512

                                                                                                  bf63066bdc50d833eca988fea5770047b5fb509035e7c908afeed4f2923da8115613841825a41840730c7353ce0f3cb1425ef472a66ced09001099c50cb98686

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  b86026db4df5b37b555adc24f962649c

                                                                                                  SHA1

                                                                                                  52cbbf3dfbbd8626db08a719c7b21c28db8dba45

                                                                                                  SHA256

                                                                                                  d4ad2f894f143bd0dccf32d19490b141a5fea60087459eee48f2ab2b31375c23

                                                                                                  SHA512

                                                                                                  0429734403cb3a20ca1d0b85f4ed3308576dcc1defa9979ec7dd0f9dbb04bbfbe6849b3d4ee8bce3cb57e81295e20228f3f6c3584b5d1bdc1786ea53bbc7b40f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e62a.TMP

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  761c3bb857d71b6b98d1f410596d3e9c

                                                                                                  SHA1

                                                                                                  a7cb88abb6a23bb7443d10e7d9898007964f3c9a

                                                                                                  SHA256

                                                                                                  e3ffccb1ba0c320eee6dc54d2379913b77c9fe782e40bf56e9538d6097f72e39

                                                                                                  SHA512

                                                                                                  925901d1767c105d088477fb28c3c5cef4633477ea072e5916d09074b9ceb9af68d3e20fbc701bf118cf1dc2449012a0ea6f4f3cbc6e04e3ece313c22cdda8c4

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                  SHA1

                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                  SHA256

                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                  SHA512

                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  8561fdba9355e41f371ae235475d60e1

                                                                                                  SHA1

                                                                                                  498547e9f523e60f0db9645628c71e8deafbbf5d

                                                                                                  SHA256

                                                                                                  ec34eec367a606284658f4ed5eee24d3e7ec7eb9bec2ea66a72f14753fda8bf2

                                                                                                  SHA512

                                                                                                  acc0c56bbf9fa154f077225885e4cc727afd9a4ca75a2f9fb2132e2a0465700c8d709c396fef5520af7eb1b18b1af3a5135a27552f116879ed8d52158b217b57

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  f1bf0a1d6042ee18a39eacb7acfa1079

                                                                                                  SHA1

                                                                                                  e0f2b9df77b084102bc611e47dab6fc59ab8c7dc

                                                                                                  SHA256

                                                                                                  135b7cb9aa6af4de0c18a562138d4f91008f5db85e80a542951fd9e45616a9e0

                                                                                                  SHA512

                                                                                                  99c3c2f300f049b243739b1244de1f50678b775b76a590eb3128305912b772cc31039114b4af0f07e9dee7035d33fd7e0de6a0fc7f610ff2c07341d4b7c3ebc3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  8a84ae59f39d2eb04b76a6d14d542dc7

                                                                                                  SHA1

                                                                                                  5b936833c706b9c6f1bda05d24e232ed2c80944f

                                                                                                  SHA256

                                                                                                  1be20e4e81584153f388ba29f7e76e7f55649ba182c2195f4604480e14d5fb1a

                                                                                                  SHA512

                                                                                                  a8adfc9f3c98b8082593d15112976b02b0775f179437bc9f6c380eb92124cb9d60532fe308bdc1dadcafd794c9868f4e2ad79ddeedaa9a36897f54a47d0e2e93

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  70f10772cce3fe50256093649524a07d

                                                                                                  SHA1

                                                                                                  a33ab9bf6f93788918c472f0a736557a37d5a853

                                                                                                  SHA256

                                                                                                  68a199bd3e803505559871dd1b6f164b31139baa9176501c3106527eb2c24f9e

                                                                                                  SHA512

                                                                                                  54a054d8b71432155bfa2a3c5f0878b5364b5d2e29fc8f0c9e7e8800ab9fc89f4c58f4a979c0e53ba3cf1ee5cb261b120731efaaadc55e895293b9e3d5ed2a59

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  44f072471a206824460e009bb6ad42c5

                                                                                                  SHA1

                                                                                                  fa4a452ecb1d8e773f40eb4264a50cebc5f20656

                                                                                                  SHA256

                                                                                                  d8a28e3397555c7c24a443d7912e8e53ddce6964e7075769a5be452282144180

                                                                                                  SHA512

                                                                                                  452a7af7d96596fd2f25d7ca3582c015b3df79bc9c44293066029fcbc7d112eab7f4d8d0d9c38caae769aca698a8f995bdfa2273b0a65397611bab280d0aed93

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  f60619b561588af1093765150bf6c18e

                                                                                                  SHA1

                                                                                                  c2e58772aa3bd32bae420d6115432caf19542bec

                                                                                                  SHA256

                                                                                                  2a338b229e9415a3822c6ead62a6f4976349888769492ecb0bf1b4a0d667d263

                                                                                                  SHA512

                                                                                                  589281d3205b0250d9bbfb0a2eae3c778604d9f2b52e8d8afee772639a1b3ee2618f6a4878015d94660b289359e4e3d939a97c83f0d8e24b416c5668fe75f894

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  053e5d7782f451c64d5aa0cdbbc31402

                                                                                                  SHA1

                                                                                                  c138987be33e36b11a0ae39f307bba67053d4274

                                                                                                  SHA256

                                                                                                  5f92c6c4dd6bf255fc8d87e46065f275753e0ad602a057fd2c3ffd65d7f928a9

                                                                                                  SHA512

                                                                                                  7606bbe475b85bc84e00a2d298db18cd5d437d3a403de63fe51ba27a259e0efb332d0d6afbb64a84fdb311dda76b11c108a6b7a5d0b9f2b6e470c4207ac3b44d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c783e400-5748-403b-aced-9fb110894e9a.tmp

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  9737300daf805231e924cdd31dac03f6

                                                                                                  SHA1

                                                                                                  35bb736ede3053a16f2eeb855ed6fbfc7ea232e8

                                                                                                  SHA256

                                                                                                  cdfc4bccdd8bae2e9533ed10fcb930e7a91690d2cbae5d510a4246b829c63da7

                                                                                                  SHA512

                                                                                                  8f7bb9008b893dd75e4846fcc45c5144a9b671e003893ddf3a154f804620187dfb27d9cd66fe34dcf17c5cda5ca2cf0027e56e31e54008b2ce2c6c060ab490d7

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aj5aY88.exe

                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  8208c7b25d87978016689eebd9a38585

                                                                                                  SHA1

                                                                                                  eaeed781b0ec21649f2b46213b1270c973ba8080

                                                                                                  SHA256

                                                                                                  5bdfed2df2bc65ac8cfba63562c2b4538d406a097cbb180e63eff2ad892284e0

                                                                                                  SHA512

                                                                                                  9d8cafc2dad5e3086b5cd4f2fce0812b025dee26c991266a4fd7a780295ab4a551d09a8cc45c668ee606de9e02490211f16830ab7593df61aa17c8c0e5a9ab75

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1GL53Km0.exe

                                                                                                  Filesize

                                                                                                  898KB

                                                                                                  MD5

                                                                                                  9456b866688db6e22e512536bcf7299b

                                                                                                  SHA1

                                                                                                  81bb43083bef086ea93b20d6f996da14ff27ecda

                                                                                                  SHA256

                                                                                                  bdf882d624ef6fec4d3bf4ea081894857e1bdeb9463bb49d6acbac82b933abe4

                                                                                                  SHA512

                                                                                                  beb494410ffbec20eb109ba1f4775c910781b5fd8c3bc6994c50083e8422918a5c309b8d521d47c49dbb17feed7ae3150ab8dcbceebe1741f862eb06fba14d09

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2LE3638.exe

                                                                                                  Filesize

                                                                                                  1.6MB

                                                                                                  MD5

                                                                                                  f8e7488fd4ced59d6eb387447bc37430

                                                                                                  SHA1

                                                                                                  560ed0a592273875ae66a93efd611f76a9da7ee7

                                                                                                  SHA256

                                                                                                  30d11b5bd1ed2f376bb2c6dd47299a54702bf9cfdfc0d32e5f50c1adf83ae347

                                                                                                  SHA512

                                                                                                  0e7445eb71a24e10c13a706189cc972d9d590bbd456f27b4008243161868fc6b0e86fd8fadf42f61502aa913f39e2a3fedb7de236b80a2bff05378b7ade6cdb2

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2LE3638.exe

                                                                                                  Filesize

                                                                                                  1.4MB

                                                                                                  MD5

                                                                                                  f4901e0535d9f3e3ce8e7a99807228da

                                                                                                  SHA1

                                                                                                  d2fec938c991d4ad6ae265d785acadae9295b770

                                                                                                  SHA256

                                                                                                  d74fc25acf19518ea58ffa9f2b37cda679176ddc9b70c87b34d3ceb2f8f9389d

                                                                                                  SHA512

                                                                                                  bfac53bc56d5e64fa27cd1f1fd3b15d2952d30e1ee79c285fcde5a273ae7a694e337fcb973fb73f674fc1987136c16c7e3c8682a2ac75b159fac1832c3a8d8f6

                                                                                                • C:\Users\Admin\AppData\Local\Temp\grandUIAty9nJMUSEZWve\information.txt

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  ed40994583be978c718cd1c76909fed7

                                                                                                  SHA1

                                                                                                  a63170f7db990468339877c55892a8691ac955c6

                                                                                                  SHA256

                                                                                                  9c3036b9f3fde55b6726273b6afa603acbe9b2fd69953860cfe43a8a84c93f9c

                                                                                                  SHA512

                                                                                                  a5b4627405abecd281f39d054ff79fa7b0230d4d80e4ea9e7258799af87526b2fff12a23bbab2d13597bd065dd5d8e6e8ba76c545dafe1881e57a0842c7cdc1a

                                                                                                • C:\Users\Admin\AppData\Local\Temp\posterBoxty9nJMUSEZWve\QdX9ITDLyCRBWeb Data

                                                                                                  Filesize

                                                                                                  92KB

                                                                                                  MD5

                                                                                                  250f6cee6a8be4a85cd0d78b8f9ac854

                                                                                                  SHA1

                                                                                                  48a5be711abe88c0efb7204f6c792e67a99d390a

                                                                                                  SHA256

                                                                                                  21e090219937792f360789c94785cf969cf22fb9e2ae145dec419dc4beab1321

                                                                                                  SHA512

                                                                                                  4685c2cbc34566879e5c494f1433996ce9541e048a87036876d0ec426a02a13af6ed606575306522def4dd19a3fcc34b95335f492b21960b28e8f12be82a35b7

                                                                                                • C:\Users\Admin\AppData\Local\Temp\posterBoxty9nJMUSEZWve\ZunTSaNJLBVfWeb Data

                                                                                                  Filesize

                                                                                                  116KB

                                                                                                  MD5

                                                                                                  f70aa3fa04f0536280f872ad17973c3d

                                                                                                  SHA1

                                                                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                  SHA256

                                                                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                  SHA512

                                                                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                • memory/6380-761-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                • memory/6380-682-0x0000000000A40000-0x0000000000B40000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                • memory/6380-683-0x0000000002410000-0x000000000248C000-memory.dmp

                                                                                                  Filesize

                                                                                                  496KB

                                                                                                • memory/6380-684-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB