Analysis

  • max time kernel
    71s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 06:31

General

  • Target

    f791092308977c396cb05e54cad40ffb.exe

  • Size

    1.6MB

  • MD5

    f791092308977c396cb05e54cad40ffb

  • SHA1

    490d762bd217986dce936f1dcfaf845cb141c7ee

  • SHA256

    aa6109131f311c7ec4cbd993ac6fb997dda5beefee5863895e36608288fcac8a

  • SHA512

    a100c4fc00b55b727eaf618c4a2c9b2e958e2b7accb790e7c431d852207e0e1e99944decec64ce605290337b2d5bf73931765854b09442693b02807a2b3e78be

  • SSDEEP

    49152:I6ae5enbOM+/6dTW+i54t3LisOpDeWIKm59kHW:/aUep+ypmsOpDeWIKmc

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f791092308977c396cb05e54cad40ffb.exe
    "C:\Users\Admin\AppData\Local\Temp\f791092308977c396cb05e54cad40ffb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:352
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4568
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
              6⤵
                PID:4644
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
                6⤵
                  PID:5272
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5236
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
                  6⤵
                    PID:5156
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                    6⤵
                      PID:644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                      6⤵
                        PID:5228
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
                        6⤵
                          PID:6540
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
                          6⤵
                            PID:5716
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
                            6⤵
                              PID:6668
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
                              6⤵
                                PID:6712
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                                6⤵
                                  PID:6744
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
                                  6⤵
                                    PID:6964
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                                    6⤵
                                      PID:6940
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                                      6⤵
                                        PID:6288
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                                        6⤵
                                          PID:7296
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                          6⤵
                                            PID:7320
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4640 /prefetch:8
                                            6⤵
                                              PID:8032
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7060 /prefetch:8
                                              6⤵
                                                PID:8096
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
                                                6⤵
                                                  PID:5936
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:1
                                                  6⤵
                                                    PID:6524
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8572 /prefetch:1
                                                    6⤵
                                                      PID:6084
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:1
                                                      6⤵
                                                        PID:5352
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9228 /prefetch:8
                                                        6⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5532
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9228 /prefetch:8
                                                        6⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2816
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
                                                        6⤵
                                                          PID:7112
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
                                                          6⤵
                                                            PID:1160
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5132 /prefetch:8
                                                            6⤵
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3252
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8328 /prefetch:1
                                                            6⤵
                                                              PID:7800
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9520 /prefetch:1
                                                              6⤵
                                                                PID:2536
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15134548903260487696,920666146518742851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
                                                                6⤵
                                                                  PID:8052
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                                5⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1800
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x148,0x16c,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                  6⤵
                                                                    PID:3876
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,1192591202564931015,1681103044286672118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                    6⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5148
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,1192591202564931015,1681103044286672118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
                                                                    6⤵
                                                                      PID:5140
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                    5⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4772
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                      6⤵
                                                                        PID:3760
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15900747559529661941,3814832461690467414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
                                                                        6⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5284
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15900747559529661941,3814832461690467414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                                                                        6⤵
                                                                          PID:5216
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                        5⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1044
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                          6⤵
                                                                            PID:1196
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,3395306359137185255,867485828443632789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                                                                            6⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5672
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,3395306359137185255,867485828443632789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
                                                                            6⤵
                                                                              PID:5660
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                            5⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1600
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                              6⤵
                                                                                PID:3104
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8536795499720715134,11783987510435813387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
                                                                                6⤵
                                                                                  PID:5532
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8536795499720715134,11783987510435813387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5524
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3032
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                                    6⤵
                                                                                      PID:3964
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11933590489975915690,11071126699305851619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5192
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11933590489975915690,11071126699305851619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5164
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3228
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                                        6⤵
                                                                                          PID:3328
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12126411509757654613,16502710845591146482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                                                                          6⤵
                                                                                            PID:6248
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12126411509757654613,16502710845591146482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                                                                            6⤵
                                                                                              PID:6240
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                            5⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3548
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                                              6⤵
                                                                                                PID:4300
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6897172344206014513,18198603955319374239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                                                                                                6⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:5152
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                              5⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3716
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffebdff46f8,0x7ffebdff4708,0x7ffebdff4718
                                                                                                6⤵
                                                                                                  PID:1332
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3022603829381614352,16733627371492792602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
                                                                                                  6⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:7044
                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe
                                                                                              4⤵
                                                                                              • Modifies Windows Defender Real-time Protection settings
                                                                                              • Executes dropped EXE
                                                                                              • Windows security modification
                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:7488
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3ER52Wi.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3ER52Wi.exe
                                                                                            3⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Accesses Microsoft Outlook profiles
                                                                                            • Adds Run key to start application
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • outlook_office_path
                                                                                            • outlook_win_path
                                                                                            PID:8000
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:4296
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:6116
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                4⤵
                                                                                                  PID:6112
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                    5⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:628
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 3064
                                                                                                  4⤵
                                                                                                  • Program crash
                                                                                                  PID:6200
                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Xa6aF0.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Xa6aF0.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks SCSI registry key(s)
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              PID:5136
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:1724
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:6084
                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                C:\Windows\system32\AUDIODG.EXE 0x150 0x44c
                                                                                                1⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:8104
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:7832
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8000 -ip 8000
                                                                                                  1⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6248
                                                                                                • C:\Users\Admin\AppData\Local\Temp\A5C1.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\A5C1.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:3348
                                                                                                • C:\Users\Admin\AppData\Local\Temp\A6DB.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\A6DB.exe
                                                                                                  1⤵
                                                                                                    PID:6928
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\AB41.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\AB41.exe
                                                                                                    1⤵
                                                                                                      PID:5144

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                      SHA1

                                                                                                      8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                      SHA256

                                                                                                      d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                      SHA512

                                                                                                      6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      efc9c7501d0a6db520763baad1e05ce8

                                                                                                      SHA1

                                                                                                      60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                      SHA256

                                                                                                      7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                      SHA512

                                                                                                      bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

                                                                                                      Filesize

                                                                                                      201KB

                                                                                                      MD5

                                                                                                      e3038f6bc551682771347013cf7e4e4f

                                                                                                      SHA1

                                                                                                      f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                      SHA256

                                                                                                      6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                      SHA512

                                                                                                      4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                      Filesize

                                                                                                      23B

                                                                                                      MD5

                                                                                                      3fd11ff447c1ee23538dc4d9724427a3

                                                                                                      SHA1

                                                                                                      1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                      SHA256

                                                                                                      720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                      SHA512

                                                                                                      10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      c2c58532dea8f8257fc7fc3b130e4f47

                                                                                                      SHA1

                                                                                                      7598bf3f409c448b24c47e308746899c5d0c7261

                                                                                                      SHA256

                                                                                                      f65d2f1a6b09c473f095db834689bbed59e4998c75da5b5bd5d23fb27cba29b8

                                                                                                      SHA512

                                                                                                      f557dc905d1f52a3f80627396996ed6651efa7aa74802f90583b6d8f7d3bad38bd4eb18b5aea04ce4d2e4c231e1eb815c6de73c2dce184ca11a33cdfaca77fec

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      689c06a972e20e1b646ff23a0e8d12c5

                                                                                                      SHA1

                                                                                                      2031b1cfbfa9e8a486db11d9471599f1a490c83a

                                                                                                      SHA256

                                                                                                      a623ae3e223d86877ec69aa389451b761b17f72d6b6d006e0ad9a7804c45e9c5

                                                                                                      SHA512

                                                                                                      ec7e0ca686a5fd9987fbcd4574c4abeec454b62e696398980dc44d7728d71db4f22327724eb1c19aca7622383955b40b9d4072df045f92e38731a3fdc0aa9850

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe5888d2.TMP

                                                                                                      Filesize

                                                                                                      355B

                                                                                                      MD5

                                                                                                      e6ee4e2f4b9cb1f42b32360ef2d70234

                                                                                                      SHA1

                                                                                                      a9c360db767513459d4dad659287697c35086ab5

                                                                                                      SHA256

                                                                                                      43b20207777b14ab752b4054c4e25a203435b5cb4541ad9b4ebbc90ad2724c17

                                                                                                      SHA512

                                                                                                      cb3255bb49345812099e31fc5fcaba91f35e25a3417901e9027bde834df60d20039dec12cc34ed67242f0373c519a9622bbe12d97450a035d2090c5ae52ab956

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      111B

                                                                                                      MD5

                                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                                      SHA1

                                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                      SHA256

                                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                      SHA512

                                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      0527b640c4d5bb325153080fff55d4da

                                                                                                      SHA1

                                                                                                      ffb4d9ff0e754622233fab1c5e24ca44b0b08ec6

                                                                                                      SHA256

                                                                                                      615821ff17aa3207c153501ef28b72673255a8421d860b382010f7108389cecb

                                                                                                      SHA512

                                                                                                      b3bfaaca1993c9cc9fee376d50466e6f79434e2e373e19312df41aa6fd94497857000e9de4033cc2ea227bfdaa16ed5695135bf91789531559f67fdd4ccef578

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      889c2c9576cfb5cc9a8afcf0021149bf

                                                                                                      SHA1

                                                                                                      dd58f4fadfa31cf0ec180f0d0604fc445a824e52

                                                                                                      SHA256

                                                                                                      e5d1e2096749a8cf222215bc903671c38799622ab8239aab352182b176b0c4a9

                                                                                                      SHA512

                                                                                                      c04f638b1c030afa2ae3ce0c99482b14da7dcadca536359b33fae14d1694e7b4d1f2884b0c5091f718f0d8a25564603eae6a448c378788f82ff36d67676eeb6e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      8fc23cfb4b66e6a20f68da712288083b

                                                                                                      SHA1

                                                                                                      cae09e375a08677f6409a01a1d211b4c9cfb9dc6

                                                                                                      SHA256

                                                                                                      aa5944c68e60071f4f0d25d60ebacb3b242568151ddae58b9d5de686763a05ee

                                                                                                      SHA512

                                                                                                      2528655826d03b304d91015e5f696a0beea7586327d13813c9eab21824dfcaaea16c6b61d43294ed45fe5e6693d86dcbe47c340df38016e26f6dd6f28974405a

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      13335a518a2b7158ed28aa22c9ed24aa

                                                                                                      SHA1

                                                                                                      82070878b1197368b90de265cd91fff59c366bd7

                                                                                                      SHA256

                                                                                                      0a49dc089c05b644ad01ee9e574fcdb38fb48415a77af8afe0f309947c4a1838

                                                                                                      SHA512

                                                                                                      64044db4aff768af9d79d14321ec4e7b4739b03f9c394f69758e907df15a916bdaacd440b5c1ca30325d4eef30562f2194a21ba13f55b90753e09a899237b737

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      6856bb99a1e154219efe7d08c2ffc721

                                                                                                      SHA1

                                                                                                      47ea82c845cbe2ebceba90698e7e42fd701f4b9c

                                                                                                      SHA256

                                                                                                      6bc33bc7c6714a866415962a480e6a94b76432cbee885c8753915bf76e7b1d61

                                                                                                      SHA512

                                                                                                      7d128841d16fefc73f57a4a4c3a7d2c94c423f3c8bc2474c8dfe35444e6a28ee55369b278a14708c0d0ec9fc8e254f177b2675b9b1ffc7af4bac25302bcc4b69

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      121510c1483c9de9fdb590c20526ec0a

                                                                                                      SHA1

                                                                                                      96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                      SHA256

                                                                                                      cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                      SHA512

                                                                                                      b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\24f1d0d7-344b-43ce-8b2d-c051b9df162c\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      77c49de0c59abce77875d8f69aab907a

                                                                                                      SHA1

                                                                                                      2e0ebe36dcd31ab89606c99bdec6b93a2b9d4c42

                                                                                                      SHA256

                                                                                                      73c29ea630182129f6170bd16ffc5a602a5fa31efc4c8ea8e211c8e6f66fd415

                                                                                                      SHA512

                                                                                                      c96a6b196acb4214217152aa0899603562cf9f64c3fa857d721e4ef2d2d001d5cf8c5ae6c98a856e5a757c8da517018d956d93064164fa07af9a2567626d0657

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\24f1d0d7-344b-43ce-8b2d-c051b9df162c\index-dir\the-real-index~RFe5847f1.TMP

                                                                                                      Filesize

                                                                                                      48B

                                                                                                      MD5

                                                                                                      403087953ef446c5ad1f9d2971b235a7

                                                                                                      SHA1

                                                                                                      7d5e8c5164b0d8674f60b22835c0e938bf7900db

                                                                                                      SHA256

                                                                                                      f41bd68a664b108445224bb6ae74f5746d5f26d947d5aa0e8bb2307ed311e550

                                                                                                      SHA512

                                                                                                      bc3253ab92dc727abfe6238c92df2deef92082c08b801add695be7022e8ec5c30e66de3de8879fa542d311a25c025afed6b253a7f4533ffdbb5c78f72435caca

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      89B

                                                                                                      MD5

                                                                                                      aed4a36903bad5ad195757829bae02f1

                                                                                                      SHA1

                                                                                                      165b07b9b5804d1687c8909a99c3a2a98c044e17

                                                                                                      SHA256

                                                                                                      74fb6183551156235649e40504b72846e639200c1914ebe0663a1ef96cddcb51

                                                                                                      SHA512

                                                                                                      98f2b6b6f2a782d2c9e8fab1965bde05f1d20ce24552662dd60bbd69d5b5af51a0a430560d5d4c6acc9f66938d9a65759058d597c326d679fe28b90ba9e9bf4a

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      146B

                                                                                                      MD5

                                                                                                      2bdf6d377b730038b593e2348830ce26

                                                                                                      SHA1

                                                                                                      d44bf76d01eb8d46319477fd5e649ddb33dc586a

                                                                                                      SHA256

                                                                                                      3c72b3d6eb166764c8e2032b927e99f10eb94b2aa0faaea824eb2152199b89bc

                                                                                                      SHA512

                                                                                                      e6053e2f5d64d60802818213b8b13b175685832799214975df94254e395a039e248a826668982d97700fbafd3e0919ddf9645b9f0512a6e26599adef41047465

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      82B

                                                                                                      MD5

                                                                                                      a602210cb8642bcc7cab75913dd69426

                                                                                                      SHA1

                                                                                                      ce3943e19fba2a21730e9363afb9d4cdb262c4ae

                                                                                                      SHA256

                                                                                                      873db2df1b0d40f9297108821539a6f57439c0f06b4f657a6530037019046022

                                                                                                      SHA512

                                                                                                      d842ef66bc77ade6211ea2454fbd01bd66cfb266bff10d5d4cfb2f5e48ee9a849f1f6fc51980e4adf47764da0f8a1465f0289273c9eab61fbeda7468785e0c20

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      84B

                                                                                                      MD5

                                                                                                      c65bd3e2c036681b303fbb9ccf893f97

                                                                                                      SHA1

                                                                                                      70cc415a341477b91508b96f4ae43c2e43fd22c7

                                                                                                      SHA256

                                                                                                      f4b64cf5cdab9dc2bb3025398f74562d16458d7aa12e5a0ff9e6c4fda0ba2366

                                                                                                      SHA512

                                                                                                      90a9cb628f31e1e27092e620694ab3829bfb3ddacd2e7d1590d3040275b91b32c5b6855180a39a631a99067b1665a1b71e49e832727abf98e08fe311062bb5c8

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                      Filesize

                                                                                                      83B

                                                                                                      MD5

                                                                                                      cc42e6e7a263ffbab85a0e5d7e114160

                                                                                                      SHA1

                                                                                                      093646c732c664a9e51cf0a0dcbf4526c1995f40

                                                                                                      SHA256

                                                                                                      be01979b117279a5f80e5f88f490927cddcf2cf3e1b1e69f4b821eb0104e2c67

                                                                                                      SHA512

                                                                                                      34f33f903d41a45fc5ab4067f9036cc7ba9be18ed3d43017e57a3090b1bd325d87aa9d6dfe2b3657bc6d9277356d2f0646ed7f21a7542ceb815ee548c7cb565d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                      SHA1

                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                      SHA256

                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                      SHA512

                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      72B

                                                                                                      MD5

                                                                                                      487f04d99b9a81b37e5b3e4dbcf26bc8

                                                                                                      SHA1

                                                                                                      cf61da59ab563d72d4fa7ca7085c9c0dd2361821

                                                                                                      SHA256

                                                                                                      57b9fb7149b73f00483b6526efbe61ec7a4879720d7be6a47441f48bce8c9dd0

                                                                                                      SHA512

                                                                                                      8fa03dc858b82a0cb74f181fb9abfbc8d512edbde286b105c7a918ab61bcdc9205912c91076e8307a11a8551b59b80e93234ba22de577db8d573a427f55a3ce1

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5835b1.TMP

                                                                                                      Filesize

                                                                                                      48B

                                                                                                      MD5

                                                                                                      b979d55462e3392ff7ec7241c9eb24a2

                                                                                                      SHA1

                                                                                                      795df29510e6f1573cc34bb34c548737d964018c

                                                                                                      SHA256

                                                                                                      5a74dd08d00655fcc20c32c60357921ff9d46b56c13bd62f1f566ee9688c8478

                                                                                                      SHA512

                                                                                                      2b11b08ae5935c226c3800944a637d3f91a8d144e981c848c6b0a3ae88f95531a7846f5d4f19a5ad7bc4bd172e5506aec486131015b558ac2a3db6387716fdda

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      015e6c677e7f64704b53f823bd831bc7

                                                                                                      SHA1

                                                                                                      713453e097b57d0934fb6f65ea1a882deb1b5faf

                                                                                                      SHA256

                                                                                                      4d6c2fe4a2fd83451f3cf4c4d8b4c60e67209065fc2f0557ad4b8e36c8902598

                                                                                                      SHA512

                                                                                                      8ff96f3aca2b4db45d32032b71b8d049bf5c9daf4aab17dd4ba2485963edd02bac2d2d98fc72ba4d9c28f2691b0653a9cd345d749cee8c60b989ae314b5e9d25

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      86afcc5394b95fef78e12c7dc0a01020

                                                                                                      SHA1

                                                                                                      dfaf44ca62a7254c73cc943456fa4681cd4b42f6

                                                                                                      SHA256

                                                                                                      f190087ebd581557bea6967b236a07b28e28e807f23e205d106b2321f9b31d04

                                                                                                      SHA512

                                                                                                      cf244901538daec286630ef37beac27da9cbad5cb71175e1f65e56ae8f2d55d051ba67dd738f42ae48c061c7e23d10ec72dfffe9567f43a9410025114feb38f5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      816c39c40cd756fe616cd05f9d05d1df

                                                                                                      SHA1

                                                                                                      b79110cdf6fc61a5dd57e86be95e73e57d14799d

                                                                                                      SHA256

                                                                                                      90fd491a94ff3d4783b8098f7fb3968cffc100552d96f8916db42c3f92a5e61f

                                                                                                      SHA512

                                                                                                      1734a35524117af15bf9759314148efc5b376ab5c11a4ece6358784d0b9b72156ba9e1761d07e972aa0b2bedd687a356faaf9de50b2175114d0c92a7471020ba

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      6319545e7da7811709ff5348e65441bc

                                                                                                      SHA1

                                                                                                      04d6eef60141ac046c09d4c9e4df83558e91b1e0

                                                                                                      SHA256

                                                                                                      8149797f4cdb18653dfae4e885d04a355fa8d718e14f808b158fe13c9922791e

                                                                                                      SHA512

                                                                                                      0042eee5e84e373ecf8f3367d437da449bddeb44a1c5bd8f85523086b96675660a9ae5bc300789e5f36d27c3191d934cfb36d1f6d8956194502dac26e648505f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b92.TMP

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      dbea34b3d8ad22cba3cd932334c7a5c3

                                                                                                      SHA1

                                                                                                      8f959bbce7e6c839d92a2bba73b7736d3ad80b9d

                                                                                                      SHA256

                                                                                                      b93b657badde5588996c32d9f57b7799f9b9a1d0f66bf8c1226985e8a3f55af9

                                                                                                      SHA512

                                                                                                      b54567a7412e01e37b6ef011cdf4f564ebd3a7655a120d71a1713d7f17caf65a1c2d23d3a594b6df02abeb949c4125250a60aa9a99b4878754ac10ce973fd4fa

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                      SHA1

                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                      SHA256

                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                      SHA512

                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      5dc902f6360b5ad2c70cdc66b709ec1d

                                                                                                      SHA1

                                                                                                      12fe669730ffd2aae891941e0e74d19b6798d350

                                                                                                      SHA256

                                                                                                      8ccf3f0e388090c3886052435aba6643af39d7d5833d1ee130bb4434e5891b7f

                                                                                                      SHA512

                                                                                                      1ed0dbe6707042012cc7c619b26270a1f7241ee6d72d8677f2abc637da9f74302f2d3f09cdb6e4a4488f01da969f11dae675e384c6a5af39d4b5380e3723bf18

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      1390708269ebe09077ea16ff06de4e0a

                                                                                                      SHA1

                                                                                                      17da0fd3b75ddc42ebb5f3232bd425a0fb8c7235

                                                                                                      SHA256

                                                                                                      68742f59d49c5bd834900642921739dfdf37ab0c0a9d413eceb75912ff25f883

                                                                                                      SHA512

                                                                                                      5ce12089b39f8ab8d008a1b1f6ac42fd960a4c31fe5e1f57c016464954aed429dbb5a9b578edd1dcac440b646fd7b4028892dc81a6eee96d4c29ef8f472b75fd

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      3dd3dae0675698253336755628f5bafe

                                                                                                      SHA1

                                                                                                      c9624b4df6cfb13c95672a51b2df2aa3acdf1f56

                                                                                                      SHA256

                                                                                                      825e768b74fe3d84ebdab5b91996e1efc6e76f6e01ef6aa11be9f7e8a576725e

                                                                                                      SHA512

                                                                                                      6158b52f8286ce9850ce8e961e2c11e23f1fd0598324176960fafc0ab2eb9ad977565caecdd29704c3b2bc439f8fa1c283f072fa3949e6f7a361fb34d03eb54b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      cba2f8aa9369c64c874320e9806a2229

                                                                                                      SHA1

                                                                                                      0455520a70ae6944f0c458964957c2caa28ae856

                                                                                                      SHA256

                                                                                                      f6213f0870474058381007f0ff56ccbf4ae1abfd09da0847bdc6bcddc4588006

                                                                                                      SHA512

                                                                                                      1fedada0aba7d89508aa1cc2ffa1dcb499260026ab32e5189c0de131548c2d1a3056d33973d07d48cf08c07a0d1e528335eacd02c3fbf796552e5b5b47a6d90e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      9e290f2b081ce1077cb8c6a1f6a965f7

                                                                                                      SHA1

                                                                                                      c9d51773e827e3e304e90da2083f32754597497e

                                                                                                      SHA256

                                                                                                      f1864a1b5cb74a234fea83c7ddcd1f4efde173e6c62f3221d99a4c037152ef19

                                                                                                      SHA512

                                                                                                      abf590ad4d2d8a9f52944a95cde42454c08ed953ab14505299d3e737130ea0edce6fb8b1b259e2535d84c92e44792f00e948142b1d5499f84cc4702ec5ba0240

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      ec86f771bbcd38a9849bb9d455172da1

                                                                                                      SHA1

                                                                                                      f071f69245272ea1997b5afc84ea7723a13a97d6

                                                                                                      SHA256

                                                                                                      60c537b33d1a50c38aa4f34dd70553bb70f8eecb22b6b4a2be419277ea3a25e4

                                                                                                      SHA512

                                                                                                      a1db8fb7ed551d5d3d6bc80db797d196e39844799f75a210374e3bef24b9ca2329bbb3bb08f285512e5d3889ad5e158141f7ef8701372f79ba1452f9e0a9f786

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      9b5dcdec293a583565bafb5a3255b977

                                                                                                      SHA1

                                                                                                      86996ada90dd3ca3b0b700bae04976ae53a18c13

                                                                                                      SHA256

                                                                                                      a4160f46208d86e32f506b183017f577a1cb7880bdde516b44f599ce28d6e20d

                                                                                                      SHA512

                                                                                                      75654af0b31f3acfa293dcf6e5a5974af337b56f2f7ee6131ccda08c479eeb80c73d74ba231bf06b46ede66fdf897a74033de7fda92e4ea7cde2213efecfedf5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      3fda9b06ef6f92133a13a760ad9aca65

                                                                                                      SHA1

                                                                                                      505515a160f5caed164580107fd691534d630337

                                                                                                      SHA256

                                                                                                      bc6ea0ffdd289ec69313f4350226d2a7b3b8c8a056d28ecb3dc4d0057ddac9ff

                                                                                                      SHA512

                                                                                                      3b1a26cda6baa3c2e5a25fd1593e7f0f32aefb89afbd55e23ed995dddece6fa8cddc91127aa804e05fc35c84006e63bafa86be793db71d2b3ab9800b80c00b73

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfc7c98b-a810-4451-b8a5-3f5429922278.tmp

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      54d32b1f6eee6679a262b7db0c78fbce

                                                                                                      SHA1

                                                                                                      994815094b8da0dc0878aba3f17f3f6c05ce3742

                                                                                                      SHA256

                                                                                                      f51909e186ce9c5bd3f48c9a00af259c049ef46178920b7801db4ff0c590843e

                                                                                                      SHA512

                                                                                                      c54c405c865a0c1a6ef7dd86c89a22e2c109e4baff22d2c3fe88ea68b20bd832911eea571a254675755864c3c7683a14dca5f1857ef04002033b379015980947

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                      Filesize

                                                                                                      802KB

                                                                                                      MD5

                                                                                                      4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                      SHA1

                                                                                                      14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                      SHA256

                                                                                                      25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                      SHA512

                                                                                                      c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      MD5

                                                                                                      a77cc3a09762cd0c5ff1665efd071481

                                                                                                      SHA1

                                                                                                      56841bf775833ea7710ea330d6246c0a8737bea2

                                                                                                      SHA256

                                                                                                      c479b550f4022a1dd60ea0d0f41af3509f61a4a661080df6992d5f2d41e3693c

                                                                                                      SHA512

                                                                                                      63a690d6659f0a833c31e725e1122769db267caac11c2b82d0cf7b320711bd5641658f2fc8b5ca3af775abc222f54a641687fbc230ec4bacadf8d98cd3dd0233

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      f65510e4e22bf941166ed037c30d73da

                                                                                                      SHA1

                                                                                                      6f870d9120294e6b6ea349e41322eadb498035c5

                                                                                                      SHA256

                                                                                                      fa893242a5e1cf3419890017a6bda3c3490d58080b40b8d0e49f74cc2adcf473

                                                                                                      SHA512

                                                                                                      c6ed075369b42a6d4bbcc9881e9b730bbc450073cd810e3d39a7f47541299c6f45205461a34b2e4b420c5a774fc965ea691f898030301f982b98fa1bb48482c0

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe

                                                                                                      Filesize

                                                                                                      895KB

                                                                                                      MD5

                                                                                                      35b5e1f030022f1a4e7455fd5e68fd54

                                                                                                      SHA1

                                                                                                      f1dd4915925e7b25f2f0af97ca45d87f9196596c

                                                                                                      SHA256

                                                                                                      7207fcfb0f7bb9e16f376914f59b8fcab071910f787cce6a087ed8e2c5c1fe41

                                                                                                      SHA512

                                                                                                      502258f6f13fb69e26cbd663c74a69a941c0b2156e20eb462dd6d5c83cc3403cda6277f89c6825cc32f20cd69b330773d0812a7c682cbe68c869361469f563b6

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVSi0wL26fkFxeh\cQSFRZHnMREUWeb Data

                                                                                                      Filesize

                                                                                                      92KB

                                                                                                      MD5

                                                                                                      ec564f686dd52169ab5b8535e03bb579

                                                                                                      SHA1

                                                                                                      08563d6c547475d11edae5fd437f76007889275a

                                                                                                      SHA256

                                                                                                      43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                      SHA512

                                                                                                      aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVSi0wL26fkFxeh\x1pa4qjaWVDpWeb Data

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                      MD5

                                                                                                      00d15db7e52b7653a57e90cc71278102

                                                                                                      SHA1

                                                                                                      08331e9e1c8d78c3d000d55b6f89396fd69ba07a

                                                                                                      SHA256

                                                                                                      8112aada19e1ff8e6dff8460418fac9b71f4f78c236da6ad3a7b73802b938f4a

                                                                                                      SHA512

                                                                                                      a212fb0f9280db249409e88379aa96368b889b94dca9ae8e4aecb5e08ef8beece5cbc8b87ae0fa1f3e4c7c7e41137c28857fff2248fb72c726437926f78fa0a3

                                                                                                    • \??\pipe\LOCAL\crashpad_3032_ITMWPUPNLRCATYKD

                                                                                                      MD5

                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                      SHA1

                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                      SHA256

                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                      SHA512

                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                    • memory/3532-1036-0x0000000002D70000-0x0000000002D86000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                    • memory/5136-962-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/5136-1038-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/6928-1536-0x0000000007D40000-0x0000000007D4A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/6928-1535-0x0000000007F80000-0x0000000007F90000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/6928-1534-0x0000000007DA0000-0x0000000007E32000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                    • memory/6928-1533-0x00000000082B0000-0x0000000008854000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                    • memory/6928-1532-0x0000000000F70000-0x0000000000FAC000-memory.dmp

                                                                                                      Filesize

                                                                                                      240KB

                                                                                                    • memory/6928-1531-0x0000000074460000-0x0000000074C10000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/7488-316-0x00000000008A0000-0x0000000000C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/7488-306-0x00000000008A0000-0x0000000000C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/7488-659-0x00000000008A0000-0x0000000000C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/7488-317-0x00000000008A0000-0x0000000000C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/8000-677-0x0000000006F20000-0x0000000006F30000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/8000-665-0x0000000000010000-0x00000000000DE000-memory.dmp

                                                                                                      Filesize

                                                                                                      824KB

                                                                                                    • memory/8000-666-0x0000000073D70000-0x0000000074520000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/8000-670-0x0000000006E50000-0x0000000006EC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/8000-960-0x0000000073D70000-0x0000000074520000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/8000-749-0x0000000007F40000-0x0000000007F5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/8000-773-0x0000000008460000-0x00000000087B4000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.3MB

                                                                                                    • memory/8000-842-0x0000000004AC0000-0x0000000004B26000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB