Analysis

  • max time kernel
    53s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 04:31

General

  • Target

    38ea2d1cb81742c1e080f1c43a0435b9.exe

  • Size

    1.6MB

  • MD5

    38ea2d1cb81742c1e080f1c43a0435b9

  • SHA1

    36c7f933fd3996298574e5c11777d459c101f3cc

  • SHA256

    70d432aaae6f900cb7d7e8cc0d4b78551d905d1ac9e208d4c73c4ead3b4f97a4

  • SHA512

    b94d6934b76c8b3ad2e6ae8576beef4eb99c340fc451eb6e5cd19fa180e97d7d938e533f1e91dccddb09ec14f422a821a6e9c9c7e3b78d8f51a6d80442b4f7d3

  • SSDEEP

    24576:7yLM8BftnwZjG8pK1XnkC0RqotFEeuAuwLZaDDhBuIiRiyimhK4GK:uLM8BFwZjHK10rqHVOoDDeIiwTmsD

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38ea2d1cb81742c1e080f1c43a0435b9.exe
    "C:\Users\Admin\AppData\Local\Temp\38ea2d1cb81742c1e080f1c43a0435b9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PU8xS11.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PU8xS11.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\la9ie03.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\la9ie03.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vZ21wz3.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vZ21wz3.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
              6⤵
                PID:3220
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,2579965360407329493,4311888618669765948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:6028
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1472,2579965360407329493,4311888618669765948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
                6⤵
                  PID:5788
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4012
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                  6⤵
                    PID:2576
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8246810640472251104,17369516234478243916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6100
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8246810640472251104,17369516234478243916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                    6⤵
                      PID:6020
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1532
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                      6⤵
                        PID:4944
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9364799642349386985,1336699186653989356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5476
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9364799642349386985,1336699186653989356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                        6⤵
                          PID:5468
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2016
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                          6⤵
                            PID:1492
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10620833560966314648,13787594292588014665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                            6⤵
                              PID:5612
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10620833560966314648,13787594292588014665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 /prefetch:3
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5832
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                            5⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:2660
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                              6⤵
                                PID:1716
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
                                6⤵
                                  PID:5596
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                  6⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5316
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                  6⤵
                                    PID:5308
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                    6⤵
                                      PID:5400
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                                      6⤵
                                        PID:6244
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
                                        6⤵
                                          PID:6428
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
                                          6⤵
                                            PID:5860
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                                            6⤵
                                              PID:5724
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                                              6⤵
                                                PID:6532
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                                                6⤵
                                                  PID:5268
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                                  6⤵
                                                    PID:7188
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                                                    6⤵
                                                      PID:7212
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                                                      6⤵
                                                        PID:7360
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                                                        6⤵
                                                          PID:7608
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
                                                          6⤵
                                                            PID:7628
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6996 /prefetch:8
                                                            6⤵
                                                              PID:8124
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7572 /prefetch:8
                                                              6⤵
                                                                PID:7528
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
                                                                6⤵
                                                                  PID:8044
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7832 /prefetch:8
                                                                  6⤵
                                                                    PID:2868
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7832 /prefetch:8
                                                                    6⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5608
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
                                                                    6⤵
                                                                      PID:6768
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
                                                                      6⤵
                                                                        PID:1528
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                                        6⤵
                                                                          PID:7860
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                                                                          6⤵
                                                                            PID:5868
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6776 /prefetch:8
                                                                            6⤵
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5936
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                                                            6⤵
                                                                              PID:4776
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4492010473100582999,7622269305047214337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
                                                                              6⤵
                                                                                PID:5672
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2432
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                                                                                6⤵
                                                                                  PID:2140
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3928977015174718829,9963287588082312769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5380
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3928977015174718829,9963287588082312769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                                                                                    6⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:5484
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4788
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                                                                                    6⤵
                                                                                      PID:1144
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,6165875244177394768,5994404755991509757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5576
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,6165875244177394768,5994404755991509757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                                                                        6⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:5840
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1912
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                                                                                        6⤵
                                                                                          PID:4880
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4622133298277678791,6478188076992175011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6808
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                        5⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1628
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbdd5746f8,0x7ffbdd574708,0x7ffbdd574718
                                                                                          6⤵
                                                                                            PID:4740
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7161800114887025696,11020385974179506426,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                                                                                            6⤵
                                                                                              PID:6316
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7161800114887025696,11020385974179506426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6440
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sp8088.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sp8088.exe
                                                                                          4⤵
                                                                                          • Modifies Windows Defender Real-time Protection settings
                                                                                          • Executes dropped EXE
                                                                                          • Windows security modification
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:436
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3pf50hI.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3pf50hI.exe
                                                                                        3⤵
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Adds Run key to start application
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • outlook_office_path
                                                                                        • outlook_win_path
                                                                                        PID:7052
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                          4⤵
                                                                                            PID:7840
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                              5⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:7776
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:7896
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:6836
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 3108
                                                                                              4⤵
                                                                                              • Program crash
                                                                                              PID:7388
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5np8dS8.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5np8dS8.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Checks SCSI registry key(s)
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          PID:3056
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:6456
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:5420
                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                            C:\Windows\system32\AUDIODG.EXE 0x470 0x4c4
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:7196
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:8060
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7052 -ip 7052
                                                                                              1⤵
                                                                                                PID:7164
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2DC2.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2DC2.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5712
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2F49.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2F49.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5732

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                51ccd7d9a9392ebca4c1ae898d683d2f

                                                                                                SHA1

                                                                                                f4943c31cc7f0ca3078e57e0ebea424fbd9691c4

                                                                                                SHA256

                                                                                                e36c7d688cd7d187eacc4fc1ccdd2968de91cee60f15ecb0e0d874da07be7665

                                                                                                SHA512

                                                                                                e3773c19314c66f09c0f556ade29cd63d84cc778be64060a570eed8f6c7918b7d09d2694d9e2d379bdaecb4e20cb140749a8111ef267c67a620d64cb598e0619

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                Filesize

                                                                                                152B

                                                                                                MD5

                                                                                                7a5862a0ca86c0a4e8e0b30261858e1f

                                                                                                SHA1

                                                                                                ee490d28e155806d255e0f17be72509be750bf97

                                                                                                SHA256

                                                                                                92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

                                                                                                SHA512

                                                                                                0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

                                                                                                Filesize

                                                                                                201KB

                                                                                                MD5

                                                                                                e3038f6bc551682771347013cf7e4e4f

                                                                                                SHA1

                                                                                                f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                SHA256

                                                                                                6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                SHA512

                                                                                                4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                Filesize

                                                                                                23B

                                                                                                MD5

                                                                                                3fd11ff447c1ee23538dc4d9724427a3

                                                                                                SHA1

                                                                                                1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                SHA256

                                                                                                720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                SHA512

                                                                                                10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                Filesize

                                                                                                396B

                                                                                                MD5

                                                                                                42525cf57669473ee001771d58aa1023

                                                                                                SHA1

                                                                                                fafb22de0e79b2e887fd7cb72dbd0fdcd2f58112

                                                                                                SHA256

                                                                                                52c4f4550eec1715a59a58889d8c473af913a5cc3660b41060e6b5976f3049b0

                                                                                                SHA512

                                                                                                a0c2fad1c75667ee3b6a5c4343b3600ad6ffd5c9ce7b8076592fe6ec70ccad60f4dd24d17656aaa224bdb8cb0cbb2a131c00be54d1ccdd8b16e6fe65e484c5af

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                Filesize

                                                                                                393B

                                                                                                MD5

                                                                                                6ae6d79a521cda82e9319f7d985d42d2

                                                                                                SHA1

                                                                                                4ee87d5a60681b2dff2d80e015357a972c5069d5

                                                                                                SHA256

                                                                                                e026d1b19841ad5893f2915e174064ac8d58b084451392eac2afec12fc2b378d

                                                                                                SHA512

                                                                                                abbbec5d56f9e74486824981f71535d718986dadca94bb4f8d9a5502606389e800c8bf72147ae666bac93bdd29d5d07d0fb827aacca68df973689f0758408e08

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                Filesize

                                                                                                393B

                                                                                                MD5

                                                                                                453e59af13fa90941066d35848d14539

                                                                                                SHA1

                                                                                                97036e32df89f94e5f7701a7458c90cbc3ffe959

                                                                                                SHA256

                                                                                                8c8e95116b63a71e9d85a503e8ec2f9cb580793a1bb070c806ffa2ed266252fe

                                                                                                SHA512

                                                                                                2bf830535f748d4cd3b842431e65ba5387f0a1edf5ca1a67a8e3f40d5bd994a95795394ac1374af4f60bdff25e0e1d2fa50be6efd16a574ef99da14b1544188a

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe580b07.TMP

                                                                                                Filesize

                                                                                                355B

                                                                                                MD5

                                                                                                79adbb5fc98adb300f9f1c50506875e7

                                                                                                SHA1

                                                                                                54df1abdcd0b84d326cc5d6943a9d3e1035ec3b6

                                                                                                SHA256

                                                                                                9237d9f27eeb89997460e70de56ac668581ba63a95c28796aa5cdad431bb9fe4

                                                                                                SHA512

                                                                                                6bff0b816e5c22e65f3f6230e62a4d4d283b43ef9e549b804e6cc38bbcc9d5dea5df121dd57ad22085921976590a1c002d36e1c774490eba3ab66d6cb36cc116

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                Filesize

                                                                                                111B

                                                                                                MD5

                                                                                                285252a2f6327d41eab203dc2f402c67

                                                                                                SHA1

                                                                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                SHA256

                                                                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                SHA512

                                                                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                Filesize

                                                                                                8KB

                                                                                                MD5

                                                                                                69462290703e4b020344af446cd6b237

                                                                                                SHA1

                                                                                                24b233a9233def17579b8088b11bccfb34baf5c6

                                                                                                SHA256

                                                                                                261b07b7676e05bd4692be5dfa37d5be338a561051fc89aa5b2b0b6789825522

                                                                                                SHA512

                                                                                                7f8552c4a28dbd6d083159760a665b67571f6ef291bec05e5896fe37ff28f9b5d8a62fa0aa957844273adea634a8f977a4c1e0fa9e2582a57e496beec78d370d

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                Filesize

                                                                                                8KB

                                                                                                MD5

                                                                                                24bafcfd1827a9430ba84ddb11173303

                                                                                                SHA1

                                                                                                64f0f0115bd89ac5224a9e234161944b2e51681b

                                                                                                SHA256

                                                                                                14a74677f076bdfcff302304273a70c83a67094d79d4255180ffe08630e79f3e

                                                                                                SHA512

                                                                                                6c952d23ba22abbf52e29de250df5fb01e4784f93bdd1720dff04f36f57aafd3cc83c3d2c94b738569a6a2e1506a279d6c58b0374f91a81b856e9f7876ab03ea

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                Filesize

                                                                                                8KB

                                                                                                MD5

                                                                                                cb5bb9f17e1a00c368094b409457521a

                                                                                                SHA1

                                                                                                d21aaeac0da1a723cee7db43821a78322ec998e3

                                                                                                SHA256

                                                                                                b0ea043d5424739c7bf1dc70b97e36a1067f8532753aa42fd4585f03669afcb6

                                                                                                SHA512

                                                                                                99b528c9c70887a8cc52304f5c343dd14ae7672ad11662f108b9f8d3b6b6c46c2387b226451be5ca6e22b33913ea0f76ca19fcf7c260c4695ba29d2e81fa8863

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                Filesize

                                                                                                5KB

                                                                                                MD5

                                                                                                1b4d6b341dbfc4cc0c601943c560ec1d

                                                                                                SHA1

                                                                                                4ee5d5c7357185e8582355c96dc24214a698d51a

                                                                                                SHA256

                                                                                                c2daf6bbbb11833556216e81d2337d37acf631992bed9cdd04fff51697bd16ed

                                                                                                SHA512

                                                                                                b2a13708cb48f077a8758cb7baed64067e96bfd5acd93ff91b4e5b3e58d2f0fcd793a33ab7da48901e520cd4304a93476bc3d0bd2fb7faaa506dc62e746dc1a1

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                Filesize

                                                                                                24KB

                                                                                                MD5

                                                                                                52826cef6409f67b78148b75e442b5ea

                                                                                                SHA1

                                                                                                a675db110aae767f5910511751cc3992cddcc393

                                                                                                SHA256

                                                                                                98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

                                                                                                SHA512

                                                                                                f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0de53893-d78d-40c0-af95-20f0c2861c95\index-dir\the-real-index

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                957a32a44c2b57af0471a04528ed8e08

                                                                                                SHA1

                                                                                                dcf939827770bb7ac1a95dd2099a7b4a82cc155a

                                                                                                SHA256

                                                                                                281dabd66d40275abd8063c5c7a34f4b9d6dfcf4f7c1928e2bf768bf4e85c869

                                                                                                SHA512

                                                                                                6aa09b707fa40379f95548add992fee886b2ae897608fbf9c5ceadc491badbc18d86bba689d5087c226b68a48434ba7b8395ad16f180005016c44b054379c1e3

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0de53893-d78d-40c0-af95-20f0c2861c95\index-dir\the-real-index~RFe57e5dc.TMP

                                                                                                Filesize

                                                                                                48B

                                                                                                MD5

                                                                                                0da61e4cf8374423d71d20629f556e8a

                                                                                                SHA1

                                                                                                b218c869bab44c2ba862e3ae8a86baeb9d3ca594

                                                                                                SHA256

                                                                                                24f63a202a67611c1070958879d39f6a01cc51bf44519e463b14bfb8766869d4

                                                                                                SHA512

                                                                                                5f8a6cb21628dd4c1e76e266cf808dee120dd02c981960338e8a4347741fda7f3b267b067cd2077b64ca89657f386d17aaed084a53c5777c00a7177eef32bf86

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                Filesize

                                                                                                89B

                                                                                                MD5

                                                                                                0b23281a0c6138f957c686aec188c9a8

                                                                                                SHA1

                                                                                                2e33cee3f2a8e5a7a0bd4ab6b621f7f7378d79d4

                                                                                                SHA256

                                                                                                4e28adb8d013a02345412ee8f809da909f5dcc893eaa0ba3d98cec212c6b8fe5

                                                                                                SHA512

                                                                                                188c35de964e5fdcf255d9c151ea493f7addd7a371c072e135db582869bd94ef1e3684e0369efdde991ed974da0b4e88b2f34c8e7d3e045cb443a3f7bb7f0425

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                Filesize

                                                                                                146B

                                                                                                MD5

                                                                                                9f34e8b3463a6dee15e246640f939e5c

                                                                                                SHA1

                                                                                                4edb6a6f60639a236bdd3d84ec0c42ef0180e806

                                                                                                SHA256

                                                                                                4794c7818568cab87eb82ae3bd984d413c06e663c4d9961694448b8818ee3d30

                                                                                                SHA512

                                                                                                a1c1a619fb3f4ac83bcf983c0a5648a96f4f35aa3ee6b8066a11ec2d7ff55982d6b480071cdeb27708212a12c28b3c31c36cc852e41996082f5fc4e6731165d7

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                Filesize

                                                                                                82B

                                                                                                MD5

                                                                                                d1e4a111a23152d4e358e31bab22114d

                                                                                                SHA1

                                                                                                c8632b13083738bdccc177c4c9dd78da684fd6b5

                                                                                                SHA256

                                                                                                87ee5a5d61a1614bc64b4251b4401b1a7859d815c731642c9fc71013c2cdc1f0

                                                                                                SHA512

                                                                                                18951296802d506293e299cb4b17b3016748d51531f1eb9f5dd42d06d7222593fa8e3d255eca8741255266977a089f613b54a6ca1710bcda715a080de8b0bdda

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                Filesize

                                                                                                84B

                                                                                                MD5

                                                                                                a069a40fc2883b7035e53d30888e88b2

                                                                                                SHA1

                                                                                                1b86fb387934d671e0fed7c562003afe0dbcec04

                                                                                                SHA256

                                                                                                e9bb0eb10290a1791bfb4ddc5c5ac15343b9bcec0ed779bc8183b5348ec86ba3

                                                                                                SHA512

                                                                                                41b7a2d1391d607a4f057544b4691da33728cdd045c866837b54756e1d4a465533fd34eeaa23057792fba4b779d6cf241a96b34d6a022cc48291c3f5355ac3ac

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                Filesize

                                                                                                83B

                                                                                                MD5

                                                                                                12c687187964602305a53482b84bf646

                                                                                                SHA1

                                                                                                1e587acad8b18b37fccf86afc8cbdac80acb3f88

                                                                                                SHA256

                                                                                                838f786845a8a1fd39263d494be837d21b0beb8303de81f8b0f64f712b1ef300

                                                                                                SHA512

                                                                                                3920d12363cd899ec42e5b540e5046a9e0a77f5d7bb2b0caf20daea5dc3d0674bf1a1aa6eacca0821cc1730490c49764819f2effbec945e52782452c4a8ab0ab

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                46295cac801e5d4857d09837238a6394

                                                                                                SHA1

                                                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                SHA256

                                                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                SHA512

                                                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                Filesize

                                                                                                120B

                                                                                                MD5

                                                                                                0649469d292792c48c58c84302383aa5

                                                                                                SHA1

                                                                                                c870a73d5d86472a5a5a5b6c2328a8ace74755dd

                                                                                                SHA256

                                                                                                4567caf6334b823b1b9e5b08a890e1ca1c2f136e29f100e971df7f5c5e1c11fc

                                                                                                SHA512

                                                                                                343c557f8aebab823d21ac393c09915c6c0abdc5fb6a550137f8736a4e8c8ef2915ac44932b224388f0243b9a44fb8b112d43b545d527a57accc53fddafe4ba2

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5829f9.TMP

                                                                                                Filesize

                                                                                                48B

                                                                                                MD5

                                                                                                f180f1c8140880bfcd63b8fdedc81da1

                                                                                                SHA1

                                                                                                d6c3aa71ac3d96ad02aec5a7f704688d23d4da92

                                                                                                SHA256

                                                                                                1c08fc5148d43b0eb399d944c562770aa040a90d1da127dd3d7de8b7671255f3

                                                                                                SHA512

                                                                                                43e89590c437854326923132a571e335635c9c6c64139f74fda8bf895f7b0c9b814c7f5f5dd99a1349ecf6eb72cbae6f4fd37ea0f0e4c046c8eb9d086d20163c

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                Filesize

                                                                                                3KB

                                                                                                MD5

                                                                                                6c1bf32c5a54d6e438e26fa9477f7277

                                                                                                SHA1

                                                                                                c9004a79b27aa4004577c7470133d0ee3d7729c7

                                                                                                SHA256

                                                                                                5ffe9bd04eb86a0418982e9dc5beacfa331077e762aac736b8e15ca3d420d991

                                                                                                SHA512

                                                                                                b423a84886939156c4269933c43759f607fa01fa0ba16a34aff3713602cbb79b3f02f4ae4c2687359908012d69d00c3e1f9576de9e594900074cbef8a1b2cca7

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                Filesize

                                                                                                4KB

                                                                                                MD5

                                                                                                6839e8621d6b2d860dff8ed9e39d569b

                                                                                                SHA1

                                                                                                576ab448dda56f4a9acc4754c9e67b61e6a927c8

                                                                                                SHA256

                                                                                                8d19e62a4fedb91784e664aa6cac7bfa8b0952e5732fc7899291c9bf83f4027c

                                                                                                SHA512

                                                                                                ed3ba8abbc3997dc1e9e60e97ca2e4904d80ac18edddc714c9391f2407fc9893eef1253bcf88dfd0c6d3b50addc88e6f6260448758c2ffc9687a73d9a4ce8134

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                Filesize

                                                                                                4KB

                                                                                                MD5

                                                                                                558305e5ddce057286c4e80dfe8420f4

                                                                                                SHA1

                                                                                                c571357b836083b3e09db892f975307940ce20a5

                                                                                                SHA256

                                                                                                2604ea7ac35ce1ce767216cd6fb868463763e09be6eba5ba2a186c114fab622e

                                                                                                SHA512

                                                                                                5d5229b8a692ee44bd30b1d67a5c6b6636a6a800cce6f493382a410fda046efd19987cd550d00c68da39fd5bbdfaad2272f2ce6b1fb5004c87bce2c877ff1f0a

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d30f.TMP

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                e35762968ff53a14b05a457cead0ee4b

                                                                                                SHA1

                                                                                                2e1f759c526d49e8e42aceb9caafbc9d2bc5b1b2

                                                                                                SHA256

                                                                                                682d10e04f74777587fe7a656412e50d58eda11184ad224bf5e4b657dca843ca

                                                                                                SHA512

                                                                                                326e48ec47f0ee2ad15ced1ed6604dc0c55efb845b108bd42dc9bc6a2452cd0b57f1375a11478fa185370402952c65335940e50d7124bc53ca6d2e5dcc2ea580

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                Filesize

                                                                                                16B

                                                                                                MD5

                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                SHA1

                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                SHA256

                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                SHA512

                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                b64ebc06a3a922d680e4a58d53bf96b1

                                                                                                SHA1

                                                                                                6edc97ac629efdc9979c893ec56e623b89c0ee58

                                                                                                SHA256

                                                                                                e4836d58ce5f799c0c43c233702243e767a567a0d75141720eb9bb35c7ea2bd0

                                                                                                SHA512

                                                                                                f1cd20f9b704552348990453e78f0b4bbd00198ac293df6482f7775cbe954e3825edd4200a5b157e204012b89d07f45e28bc7aa648c0f5606fa41b0f804f5292

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                fe8e0f4ad1de90dedfc2d444c56ce77a

                                                                                                SHA1

                                                                                                e14d27993a8c473ce8ff57b1d893cc6bf01cd52c

                                                                                                SHA256

                                                                                                ec06756d83e560822886f119b1f5b35420dad51db367279f1134c3e12294b393

                                                                                                SHA512

                                                                                                2ee8cfa0dcd70b6ca9157262b0b184bc9c6e21b2f48dfd35a3eddd568bdcd096b19113dd5423cb49d190a5dadab84b6fdfe86e3c426b4129016dd3376e890faf

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                2f8588805fd4ca49fac7b91290f6ae9b

                                                                                                SHA1

                                                                                                19464f3edd8d7b874d6f1ab7a2975707aad96da0

                                                                                                SHA256

                                                                                                e2eb3a39cbb017ec2ee9081022be357c8ade8ee28a15a7c02ebe0973d5e07392

                                                                                                SHA512

                                                                                                ce2685a9cd800ee4c6ce8d2fd4c0dbbbbc6d1c1570e383ab046be7100bc00b00ab462c6447b9a5bc5b2791fc591e60b49ef836da8aa80a84f668d00018ec8cfb

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                a96dd54fa123d09f85b3669f503d4210

                                                                                                SHA1

                                                                                                edd2f3f744d41c2816753bbbb20ff3f9598b04ff

                                                                                                SHA256

                                                                                                b7eccb0506392fa2852e7b203f2ecea675317afd2dae3a4820b13c8e89faf2da

                                                                                                SHA512

                                                                                                b3477f011e565ba908c0822bb8bbbe1b11412c5168ce5d1785be4ed2918fdc73703259f39039f19b8f77866071ad5c69dfe780965f8834d5e19bf080aecf9679

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                e079b8a62fbf16d37aa860609f779d19

                                                                                                SHA1

                                                                                                e3407dccfe00cff6b84c5db6e625701f582773ab

                                                                                                SHA256

                                                                                                5baf7a31ca21bd506aaa4277cfbd2274223b1d3d1df3354b8c457598f9bd9118

                                                                                                SHA512

                                                                                                9c58e12abe68cdf16b66c4fbe9b649eac0d3e765426d6521a10c849dc012bb98ce3d2f07d761562563d820aeedffd5e4b9ac7370fcdc55ad913b9140dd7d0d4b

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                10KB

                                                                                                MD5

                                                                                                ad9252690e7994a75779f100e83a030f

                                                                                                SHA1

                                                                                                689837e04570259b27774d3eef9f174024a76ce6

                                                                                                SHA256

                                                                                                b9723cfe93fee96164695237d55eaad169bdc6df9d5df5fc0fc0b99f4edcd333

                                                                                                SHA512

                                                                                                430f8cebb5e4851b1d0673be3f97513dfd93036304bf6b6e003711207dc161395e9a13d8c495fea0115868bac6a9b242b64073997815a2d4aac1273aba39656f

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                Filesize

                                                                                                10KB

                                                                                                MD5

                                                                                                b0d13a77cb0a9962c434f30a1dd55de5

                                                                                                SHA1

                                                                                                217fcfa0fe84a618ea3a0585a55921a57fa1e107

                                                                                                SHA256

                                                                                                ef7edbdadefcf60f135d61059f08b943bf2d5db658e4374616d3a50d8dffff9f

                                                                                                SHA512

                                                                                                f42cde1626dd518f1f886a299bc88d5a412344c3b576b2c992527104cf36b8a6352aebef8b3ab7a8664ade2b8ca43503a6c69524123570156768c51f8716bdc9

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\abc90d2d-c382-4d93-9591-e4894accec3d.tmp

                                                                                                Filesize

                                                                                                2KB

                                                                                                MD5

                                                                                                2c21e1e253b915d5c401726b16f8de38

                                                                                                SHA1

                                                                                                1b9665738c9f53f431b228120c1062e8eb364816

                                                                                                SHA256

                                                                                                f4e286e54d04b01d050183339e7032fac2f26484b8e36feff02d94cb73f3d4df

                                                                                                SHA512

                                                                                                8327fca14a008f2dcc9350047b3ff2589d18683689d6b360d2fe281608b1d28fb506d95a79dd82cd9426b7457d63a54d718c9062efc6f9ba04bf633bdc8034cd

                                                                                              • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                Filesize

                                                                                                802KB

                                                                                                MD5

                                                                                                4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                SHA1

                                                                                                14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                SHA256

                                                                                                25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                SHA512

                                                                                                c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PU8xS11.exe

                                                                                                Filesize

                                                                                                1.5MB

                                                                                                MD5

                                                                                                f39ad9e1c5b5944b8addb64e8fc32dca

                                                                                                SHA1

                                                                                                f2e0571374b1d5a28f8f06c659ad453053526b52

                                                                                                SHA256

                                                                                                fe7256aeafa7434ff20a98f2134b98ee6c610f47fd2077d90fe63bdcce15c731

                                                                                                SHA512

                                                                                                520f7dbd774d097b4af9261b8e86ea9ecf82fc63de91d42a29fda7973e8ee955d1946b8a66f9a84e8bf6361b21bf403ebffb5e543fed9d844caad56bdad262ad

                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\la9ie03.exe

                                                                                                Filesize

                                                                                                1.1MB

                                                                                                MD5

                                                                                                2e863b41b7ec4acf7930aadf5fab012f

                                                                                                SHA1

                                                                                                e0934265681b067b0ddcc0068a4d43bed5c91dcb

                                                                                                SHA256

                                                                                                1e09da7371e9a94ff364bf07521f2013395e37601e173caf7246f6d1f0bf87f2

                                                                                                SHA512

                                                                                                27476bb1312f36a963fd1be5a45a5fe18f0a2a9049dc012a9383697ff9b143cd7d5d340bee709c04d945fc2d68c12b36cdddb2814bea440770351d172de78915

                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vZ21wz3.exe

                                                                                                Filesize

                                                                                                895KB

                                                                                                MD5

                                                                                                443b2428a53ad67385a38812682d125b

                                                                                                SHA1

                                                                                                098b44925303534aa83bff9ca3c9b2d4aeb1bd7e

                                                                                                SHA256

                                                                                                74bc314c2dba1dcd549244edc8738c905216bd47d9368e7b6fffcffaa87056f5

                                                                                                SHA512

                                                                                                cb6560395422050522b03bf73d00663ba82e581fd236e1510a296c1775520b9869fb459c85d47bda6a92beb9781e96e6c3c386ed990f993070e345e87f9fc4e2

                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sp8088.exe

                                                                                                Filesize

                                                                                                603KB

                                                                                                MD5

                                                                                                09ad33bc3340bb460945f52fc64d8104

                                                                                                SHA1

                                                                                                8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                SHA256

                                                                                                a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                SHA512

                                                                                                2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                              • C:\Users\Admin\AppData\Local\Temp\tempAVSZCb0nNRWHIeL\CXvDjB3JOVGeWeb Data

                                                                                                Filesize

                                                                                                116KB

                                                                                                MD5

                                                                                                420ca1c1300497ab29b424f6ac180c34

                                                                                                SHA1

                                                                                                1f48405e940a783fcea060186bb7e544974ae094

                                                                                                SHA256

                                                                                                906b1294614abd59f2a9e9edb7fea5698ed4397b54fe1473a5304d9f90ab7e0b

                                                                                                SHA512

                                                                                                53868cb64cdca2e72b1b52efe4c3b3277567006936694ac72344719012eab43785a7543b839292bc1b91ff2da786fc72968a8aa4e14c4db58383841bf0bf48ef

                                                                                              • C:\Users\Admin\AppData\Local\Temp\tempAVSZCb0nNRWHIeL\vnNzRsWAbgqQWeb Data

                                                                                                Filesize

                                                                                                92KB

                                                                                                MD5

                                                                                                b90cf1a5a3c72c72847629841bd1436c

                                                                                                SHA1

                                                                                                ba20945b425a6026feb6bb52e5470d3f5fbcc867

                                                                                                SHA256

                                                                                                e9b8ea92b52b3bb5ebf786c9d348c1b88cc33daf00e4acf1e479e66f163d3d70

                                                                                                SHA512

                                                                                                0121cbe71ac505d8fd4fffbb9efebdeffa39d7b0f92a41860d9ec3a352b7ea5794817d56295b483062955e8a353988c9c1bffa59e6eff374dbcab0f8a81d7937

                                                                                              • \??\pipe\LOCAL\crashpad_4788_ROBVSDRUCUVHFHUZ

                                                                                                MD5

                                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                                SHA1

                                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                SHA256

                                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                SHA512

                                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                              • memory/436-76-0x0000000000980000-0x0000000000D20000-memory.dmp

                                                                                                Filesize

                                                                                                3.6MB

                                                                                              • memory/436-131-0x0000000000980000-0x0000000000D20000-memory.dmp

                                                                                                Filesize

                                                                                                3.6MB

                                                                                              • memory/436-114-0x0000000000980000-0x0000000000D20000-memory.dmp

                                                                                                Filesize

                                                                                                3.6MB

                                                                                              • memory/436-713-0x0000000000980000-0x0000000000D20000-memory.dmp

                                                                                                Filesize

                                                                                                3.6MB

                                                                                              • memory/3056-997-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                              • memory/3056-1207-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                              • memory/3312-1205-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

                                                                                                Filesize

                                                                                                88KB

                                                                                              • memory/5712-2388-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                Filesize

                                                                                                4.6MB

                                                                                              • memory/5712-2385-0x0000000000C10000-0x0000000000D10000-memory.dmp

                                                                                                Filesize

                                                                                                1024KB

                                                                                              • memory/5712-2387-0x0000000000B20000-0x0000000000B9C000-memory.dmp

                                                                                                Filesize

                                                                                                496KB

                                                                                              • memory/5732-2389-0x0000000007AE0000-0x0000000007BEA000-memory.dmp

                                                                                                Filesize

                                                                                                1.0MB

                                                                                              • memory/5732-2386-0x0000000008830000-0x0000000008E48000-memory.dmp

                                                                                                Filesize

                                                                                                6.1MB

                                                                                              • memory/5732-2373-0x0000000007920000-0x000000000792A000-memory.dmp

                                                                                                Filesize

                                                                                                40KB

                                                                                              • memory/5732-2390-0x0000000007A10000-0x0000000007A22000-memory.dmp

                                                                                                Filesize

                                                                                                72KB

                                                                                              • memory/5732-2368-0x00000000009C0000-0x00000000009FC000-memory.dmp

                                                                                                Filesize

                                                                                                240KB

                                                                                              • memory/5732-2369-0x00000000743E0000-0x0000000074B90000-memory.dmp

                                                                                                Filesize

                                                                                                7.7MB

                                                                                              • memory/5732-2370-0x0000000007C60000-0x0000000008204000-memory.dmp

                                                                                                Filesize

                                                                                                5.6MB

                                                                                              • memory/5732-2371-0x0000000007770000-0x0000000007802000-memory.dmp

                                                                                                Filesize

                                                                                                584KB

                                                                                              • memory/5732-2372-0x0000000007960000-0x0000000007970000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/7052-785-0x0000000008C40000-0x0000000008C5E000-memory.dmp

                                                                                                Filesize

                                                                                                120KB

                                                                                              • memory/7052-790-0x00000000090D0000-0x0000000009424000-memory.dmp

                                                                                                Filesize

                                                                                                3.3MB

                                                                                              • memory/7052-715-0x0000000000BB0000-0x0000000000C7E000-memory.dmp

                                                                                                Filesize

                                                                                                824KB

                                                                                              • memory/7052-716-0x0000000073CF0000-0x00000000744A0000-memory.dmp

                                                                                                Filesize

                                                                                                7.7MB

                                                                                              • memory/7052-720-0x00000000079C0000-0x00000000079D0000-memory.dmp

                                                                                                Filesize

                                                                                                64KB

                                                                                              • memory/7052-994-0x0000000073CF0000-0x00000000744A0000-memory.dmp

                                                                                                Filesize

                                                                                                7.7MB

                                                                                              • memory/7052-848-0x00000000055D0000-0x0000000005636000-memory.dmp

                                                                                                Filesize

                                                                                                408KB

                                                                                              • memory/7052-717-0x00000000079D0000-0x0000000007A46000-memory.dmp

                                                                                                Filesize

                                                                                                472KB