Analysis

  • max time kernel
    67s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 05:37

General

  • Target

    3cab604bb8f42fb962a6989074ce54de.exe

  • Size

    1.6MB

  • MD5

    3cab604bb8f42fb962a6989074ce54de

  • SHA1

    8bbc9ad63d980a01ac78a34865807a80518b5717

  • SHA256

    1521933f23997a26e16971725acdeb119b82ab21f50283ee04aa7d73ce7484e5

  • SHA512

    2aae93bbae9a496e46abef95fc57cb7f975895f513d20d730ba9c04d9e759ed06d5609931c56e5bd788a3f0994aef2fb7171d1d8d455f2b7312ef74116e9e534

  • SSDEEP

    24576:4y5Vs961YSPIiEAktkR7N2KSTF0pSaTTkGw76TtZQ/ev14OpNiVaQc:/L7ZPhEA3fBSTBGS6xjQ

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cab604bb8f42fb962a6989074ce54de.exe
    "C:\Users\Admin\AppData\Local\Temp\3cab604bb8f42fb962a6989074ce54de.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lq8Oc20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lq8Oc20.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ss2GA81.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ss2GA81.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ZM60qK8.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ZM60qK8.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:448
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4404
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
              6⤵
                PID:4012
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9210031345782111361,11860967489451321359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
                6⤵
                  PID:5864
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9210031345782111361,11860967489451321359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:6064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4448
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                  6⤵
                    PID:1700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8641595053087725460,14618269202444460947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                    6⤵
                      PID:5596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8641595053087725460,14618269202444460947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4992
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                      6⤵
                        PID:2044
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15373117323980835900,1782464969629201374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15373117323980835900,1782464969629201374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                        6⤵
                          PID:6032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2096
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                          6⤵
                            PID:2696
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11936847113651343145,5931268371532442052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                            6⤵
                              PID:5700
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11936847113651343145,5931268371532442052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                              6⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5872
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1984
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                              6⤵
                                PID:4152
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4026035099905403910,4925013845417271870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5564
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4026035099905403910,4925013845417271870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                                6⤵
                                  PID:5548
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                5⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1736
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x164,0x168,0x140,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                                  6⤵
                                    PID:4720
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7311759654851034150,14619426429546585003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                    6⤵
                                      PID:5604
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7311759654851034150,14619426429546585003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5712
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4304
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                                      6⤵
                                        PID:2928
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14695108924788576860,6990329491532808543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5640
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14695108924788576860,6990329491532808543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                                        6⤵
                                          PID:5632
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                        5⤵
                                        • Enumerates system info in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of WriteProcessMemory
                                        PID:3484
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                                          6⤵
                                            PID:5100
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5652
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                                            6⤵
                                              PID:5720
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
                                              6⤵
                                                PID:5556
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                                                6⤵
                                                  PID:6404
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                                                  6⤵
                                                    PID:6396
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
                                                    6⤵
                                                      PID:6108
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
                                                      6⤵
                                                        PID:5952
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                                                        6⤵
                                                          PID:5892
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
                                                          6⤵
                                                            PID:5976
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                                                            6⤵
                                                              PID:7032
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
                                                              6⤵
                                                                PID:6960
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                                                6⤵
                                                                  PID:6172
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                                                                  6⤵
                                                                    PID:7308
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
                                                                    6⤵
                                                                      PID:7432
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                                                                      6⤵
                                                                        PID:7464
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6748 /prefetch:8
                                                                        6⤵
                                                                          PID:7776
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6800 /prefetch:8
                                                                          6⤵
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:7784
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
                                                                          6⤵
                                                                            PID:5728
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
                                                                            6⤵
                                                                              PID:7964
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
                                                                              6⤵
                                                                                PID:7788
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
                                                                                6⤵
                                                                                  PID:7884
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8680 /prefetch:8
                                                                                  6⤵
                                                                                    PID:6912
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8680 /prefetch:8
                                                                                    6⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4512
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
                                                                                    6⤵
                                                                                      PID:6484
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
                                                                                      6⤵
                                                                                        PID:1752
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9212 /prefetch:1
                                                                                        6⤵
                                                                                          PID:8128
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,6279939395260411900,13767352648753349136,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2444 /prefetch:8
                                                                                          6⤵
                                                                                            PID:2632
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:856
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa733946f8,0x7ffa73394708,0x7ffa73394718
                                                                                            6⤵
                                                                                              PID:32
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2071625019817790870,6422416207819713748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5984
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2071625019817790870,6422416207819713748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
                                                                                              6⤵
                                                                                                PID:6844
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sM8373.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sM8373.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:64
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Bq86Yn.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Bq86Yn.exe
                                                                                          3⤵
                                                                                          • Checks computer location settings
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:6404
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:6112
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:7668
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:2172
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:6884
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 3080
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:3612
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5IK4So4.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5IK4So4.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:5844
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:6380
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:6284
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6404 -ip 6404
                                                                                              1⤵
                                                                                                PID:7752
                                                                                              • C:\Users\Admin\AppData\Local\Temp\CEC5.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\CEC5.exe
                                                                                                1⤵
                                                                                                  PID:5788
                                                                                                • C:\Users\Admin\AppData\Local\Temp\D221.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\D221.exe
                                                                                                  1⤵
                                                                                                    PID:3324
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\D697.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\D697.exe
                                                                                                    1⤵
                                                                                                      PID:4028

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ef5ca26-2546-424d-9723-40425da2e5a3.tmp

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      1b2952110b1960f62bb0e1d97b4d0cfa

                                                                                                      SHA1

                                                                                                      21bfb162f8f7909c82c376ed27fe16d38883c803

                                                                                                      SHA256

                                                                                                      d11d81c27da5daa4e46f82c557ec1748f0ba77c5ac68212e42404d435a5ad811

                                                                                                      SHA512

                                                                                                      05c38d48c7f005e7af72f0f26dff16dc38aaa998ba58824c997d578b866aec9833982a33218501c69e3a40eeb9007f8dc559d4b0037717b34a35812651636149

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                      SHA1

                                                                                                      8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                      SHA256

                                                                                                      d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                      SHA512

                                                                                                      6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      efc9c7501d0a6db520763baad1e05ce8

                                                                                                      SHA1

                                                                                                      60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                      SHA256

                                                                                                      7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                      SHA512

                                                                                                      bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

                                                                                                      Filesize

                                                                                                      201KB

                                                                                                      MD5

                                                                                                      e3038f6bc551682771347013cf7e4e4f

                                                                                                      SHA1

                                                                                                      f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                      SHA256

                                                                                                      6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                      SHA512

                                                                                                      4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                      SHA1

                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                      SHA256

                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                      SHA512

                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      08c342fd2dd30cfdd167cd7a0e6ed401

                                                                                                      SHA1

                                                                                                      78e6d545c7db0b4822f14dca55784cc2bcf8c151

                                                                                                      SHA256

                                                                                                      52a416a49f177ea603a73fb32e0f6bfa67dc3759ae5f25cd31ae4505d6ecd892

                                                                                                      SHA512

                                                                                                      abd29af5e8009b7f78904f3b3c11d3d9d66f3f8f9972de2b47d18f53eb7aa74bf19bcb76587d9a89814c2dcab7e9668e521de15432da41bc7b930d2ee2641974

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      e029c9ca7ba9b70bde3852729ee297cb

                                                                                                      SHA1

                                                                                                      35371b9b9f95ec632c670609874a812a31efe50c

                                                                                                      SHA256

                                                                                                      2766e25d6e00be13c46097b7e5efb6535bb3c7c465965b332beab66e4aed06d9

                                                                                                      SHA512

                                                                                                      4fd4be1fbf987307566fa6e3872d82650e3f2c6a4967178ba4607532918b92192a311b13bd8c965649c4ef0f17a6498224a7ba842a1d5f59a95405fc45270c76

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      bc8c90b7e6171107eeca8870d0f3eaed

                                                                                                      SHA1

                                                                                                      0855016995e864f1562fa2257c4d76e97cbfae98

                                                                                                      SHA256

                                                                                                      6f8ce9d7e5154781c578644c5a928b6e3b7b6800c818fb169488f3ac9e386e35

                                                                                                      SHA512

                                                                                                      0a743f84ba08c5c3d76ffe5186d97a913f43b3b025ca6135d540f649fe2dad6498de291eb593453eda853618662b48d68feda8df4048cec8b135d0da70bc9d8c

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      09fae5e63d0100b9deec90ad226ca222

                                                                                                      SHA1

                                                                                                      439ac62d5301e50116a1ad661bc3ddb2bd341777

                                                                                                      SHA256

                                                                                                      c52593ad8da1daeb2e0bf6aaa7fe8440e525d9c8ead2650c02d669adf9f53ed0

                                                                                                      SHA512

                                                                                                      a3db16364887a9cd113d047affda3ae0e8a89c66328e3cac3b7c7764f1fdd9cc537dd24a4ed26dc04e1a40cee35a96281e72f13099b6e7e6ed12492bb96ab587

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      396B

                                                                                                      MD5

                                                                                                      32b8ac15c27720e0f7ef4449c6d9e2a0

                                                                                                      SHA1

                                                                                                      567dd8c12e7a4bc9e56960e2f3ca5ee3b820af2c

                                                                                                      SHA256

                                                                                                      e9e7466ada722723db846554ba0766eb704e5ae7c75b5ef78a7fa7b9aeb2f27f

                                                                                                      SHA512

                                                                                                      254d756b3daf1e5b868323ea98f9cebeb47cb5206675c84c345b317dddba176bf68326dd653d489ff7cb7a3082c95d4300c2e2a6939f5f78693cfc59c4fd0a7d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      ad4521c6c3d77c56274087e0432ae08d

                                                                                                      SHA1

                                                                                                      cf142385881499bb81728b8fb0ba2672be0a1de8

                                                                                                      SHA256

                                                                                                      972c20651ad874dfb036459677b268a243d03ccc82a97aa3c786c769251ac0b9

                                                                                                      SHA512

                                                                                                      922d3085f52015716ba4d9677c25735a8c63c2a648b2d790e55dbde77d78c77b7e1dd50ad11c858fde1f8a6f3829ad7ed7240017bf88f746df41cbe73d598585

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      396B

                                                                                                      MD5

                                                                                                      c6ca7899b820e001e2020ddd4019b63c

                                                                                                      SHA1

                                                                                                      69767b4cbc8fb6babce37a467856d984b0c80678

                                                                                                      SHA256

                                                                                                      f0e45f54dd244a52abf3dc857ebfd01e09137678dd256a3bf42d144fc82fed78

                                                                                                      SHA512

                                                                                                      f0e5bdd85d88610d51dca4d21e4bf551937e8eddb36376dc4884913512d37b10b9e3f5ca9b4dfa7b64da479b855de69ae4e2f55aca2f8fe8146198bad4fd7ec0

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                      Filesize

                                                                                                      393B

                                                                                                      MD5

                                                                                                      b54338bcc68f2a111c1bfbce815da916

                                                                                                      SHA1

                                                                                                      579439de012a34f791492ba0a9b619cc1a5a9293

                                                                                                      SHA256

                                                                                                      1f438833a78e4e475ab857708441bbc1dec2486f5bf35a7285ab004747e5f51e

                                                                                                      SHA512

                                                                                                      4db1a619a09478e2d987c4fa096b73735c4ab80a5ca82575ad9466eaa8dcb23c2c2039c86a23d44ee02181d656f574df39a6f5c356068c287e5b42549e8bd334

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe583c97.TMP

                                                                                                      Filesize

                                                                                                      353B

                                                                                                      MD5

                                                                                                      740407045994e58ffa875d967d0979f1

                                                                                                      SHA1

                                                                                                      fec4c4c9367202ee51b606cab77f75aa1c05e071

                                                                                                      SHA256

                                                                                                      441b03431d467db5066e46be115ab52bd0ce5c621aea25b36e05a6ed8559a72e

                                                                                                      SHA512

                                                                                                      e44f9fd80de190d11114c023117fdd57fa849c06b57e3f26250bf19e6324480bcbf92e2c75458c12ae059534ac1e684ea0d738fadefd66c7dddad6ecd9abab7c

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                      Filesize

                                                                                                      23B

                                                                                                      MD5

                                                                                                      3fd11ff447c1ee23538dc4d9724427a3

                                                                                                      SHA1

                                                                                                      1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                      SHA256

                                                                                                      720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                      SHA512

                                                                                                      10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      111B

                                                                                                      MD5

                                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                                      SHA1

                                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                      SHA256

                                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                      SHA512

                                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      9f5741f4227d76347898a0f9d5e9104c

                                                                                                      SHA1

                                                                                                      a221155388d4c1e0bac1f60af55bd7f2968ba3f5

                                                                                                      SHA256

                                                                                                      7489e6af3eb1c1fe672f7d7a9a48cc400bcbfc734e06cbf377cdbdc57d180548

                                                                                                      SHA512

                                                                                                      3757b7160c6aca905d700618d410236402c3924acdeb1f9e6f6abc2f63e5fb709a899bce8b7793bca06f8a39c6aedc866c15cee49272fb1fdfce94a45ea207a7

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      b0c0e34763c96903e4447754c3722d9b

                                                                                                      SHA1

                                                                                                      01888d1bd57149998f020f38ef44c0a5544d8b14

                                                                                                      SHA256

                                                                                                      6b14309809878ab0ddcf53ab122f5ced92fcc3466f364358174163cae5685925

                                                                                                      SHA512

                                                                                                      3f2f6a909127e6a8ef5a23ce1b2f008ab51db5b6c49a65141513404331f52b16bad441907e0c2a77ef1717699d1a946d055176ddc1205083c7e570afc1f9ab66

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      3c8a913a22ba9bb616347d8c0fb4a01c

                                                                                                      SHA1

                                                                                                      a892db63f5c187f011226fa1c8eecf37dfa78b53

                                                                                                      SHA256

                                                                                                      21eb5630a8130c175a351db5ed1d6469960473b972b1f4341384dd555c098808

                                                                                                      SHA512

                                                                                                      256161c5672e497d12c643a74b7bfaf31179f94af299a1f2d0f1c94adcdf4ff65ef0a28a1bfd611bbc883b66f42010e4f1668ea4f7d6e778dcd12dc2d324e433

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      73be8d061d67797383c0022a4dca3357

                                                                                                      SHA1

                                                                                                      312975b71eb7c077ef306d1ac722c57e859d1d71

                                                                                                      SHA256

                                                                                                      7fbc94af8fcef21e11c82dd379e35fa282578d572229764f5d35d766d46341b1

                                                                                                      SHA512

                                                                                                      269561eb00e4112da9126d7796dec2da8a3b9b67c1a518194a22db8cdd1d1df4b2912df1f56988e4824ac8372437222a540329805befa59d723cb99d466788d5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      121510c1483c9de9fdb590c20526ec0a

                                                                                                      SHA1

                                                                                                      96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                      SHA256

                                                                                                      cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                      SHA512

                                                                                                      b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      fc56c52753577855bb8716061bed4afc

                                                                                                      SHA1

                                                                                                      af93e3a72f3ffd688e45dfa142437898724f57a1

                                                                                                      SHA256

                                                                                                      f2a70caf678ca94f1e753dae15a23b8ca8b65ab90a7cf362deb36f66845b2c90

                                                                                                      SHA512

                                                                                                      e9a2ffcf7c692d87af0db8f43fb533f2fea0d8cf43861b9fb9c9a9a94f1fe7a1fecd1ce4327e93170d5e25e05aafd80b498e9f0e26e8ec3b10b2d494fad5369d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      1455b0eb3d3f0880b198142c383f8dd4

                                                                                                      SHA1

                                                                                                      8026595e12a3cbc43b6f7ba988cda0eb201d0973

                                                                                                      SHA256

                                                                                                      295ffdfb6e86848821d856e4c56cdd6d4c4fe37364ee89af6efeed5b2258f5cd

                                                                                                      SHA512

                                                                                                      04f5b8f84df040c2907aea2246bf08348e802c6f0e578f8b9a0ef1822bf73280d8d98b92724e085d08e04c2012086219cffb325b4cf4488cbd08b5a43bd24bce

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      2d8482aa34e638c66f67cfe4405b6a81

                                                                                                      SHA1

                                                                                                      93ef55f55cfc8517dae1aa2c52d293c69d961e32

                                                                                                      SHA256

                                                                                                      d5c12dc54541caab5c4e1fd71721536ad748cc60c568005ebea32f506fd56761

                                                                                                      SHA512

                                                                                                      fb5f08bb35e0df8167f3b74629bb9c856b031c9aee595c4dc623fbc20cf6daab583e4ab4079495aabee880fd00cd22c2fb5c0d7a5d6d0bc8c6de8bfe446c76a3

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      67588153a8e06aadd49dd910d30370b3

                                                                                                      SHA1

                                                                                                      fa30bbcf73cdd20a95a592ae74e6771808cef156

                                                                                                      SHA256

                                                                                                      162abbbd9e9780f8d37cf9d633172e719b3917c826d0270179776bb6f82c0dd7

                                                                                                      SHA512

                                                                                                      59c6c4979695e580132451b7e4d4ba81670bc5e9d5f3ca7712fb15f703c96cb62b1d2667c113357f88b82a0f67034360f8e1d763558a72b6269e9ea0f5b1aaa9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585186.TMP

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      c14a33834200074b67a129fb467823ca

                                                                                                      SHA1

                                                                                                      20d04ca79c7d79db1695bd7362fc917a591ca051

                                                                                                      SHA256

                                                                                                      57781541fd4d8b7dfb470ec559d0895df2da22a7721b56dc8af5a16b1d215023

                                                                                                      SHA512

                                                                                                      777e42474a727e5937044ce840be0b4eb80c164418c12a0cf6f9364b7894a66b52d453a4f429e032d6061b5f8461212c8a6dec3ee8597124f00c8463582b9009

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                      SHA1

                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                      SHA256

                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                      SHA512

                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      a32678c4dd4ec28cd034abf6b2d43536

                                                                                                      SHA1

                                                                                                      326067f983187ce097e5fbe9e93608b2810dace7

                                                                                                      SHA256

                                                                                                      725e195d909184ffe721d97bc7dcd4deceb4493ede4461d5900fa6b29e456e1e

                                                                                                      SHA512

                                                                                                      866667c022c9b0b9d87fda51c2426464955dd26f7da5ac8fa55b7eb28d617bc2104b6d24242660b2d08eb9213479ed9dfeff3444387165bb862aa9a9490ba3d7

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      5003a8ccf3bea338d5b9141ab6aee9b0

                                                                                                      SHA1

                                                                                                      fbe1deaa23f9eaef0e07d840278f5da5b4f27b15

                                                                                                      SHA256

                                                                                                      825be67412108e7846b2f2c72a3fc2550dc193decd4b122f5306dfffdffd5891

                                                                                                      SHA512

                                                                                                      ef2633b5de8ccff42bbd294b446388c7eb33f13e64bccda05197d42130e6285442691e57acf86b79f44ed25d446bccf6bd7e99750073316854d4d94fe5e0d396

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      6c813a167f904e7615060f8d111a437a

                                                                                                      SHA1

                                                                                                      65dc3607977fe5b640a134a0448253874e6fbe29

                                                                                                      SHA256

                                                                                                      04a4dde178d6f7b6510d4a3492d258741276477415b11fb56300131c3403ff59

                                                                                                      SHA512

                                                                                                      6ddc55144371f82e2d29fbf0558706435d15712261863b753ea5ef680235888ce297bcd0ec163eaf65ea63e09ffa0c3d68b028267f6c7be5d3d120fcc9dd7ed7

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      4872a7298ca027ce8a9246359f1dde00

                                                                                                      SHA1

                                                                                                      aa2bdbd2ba97fb62bddc62ba8cb5ed90b2dd71ed

                                                                                                      SHA256

                                                                                                      be6b389005483f9de9f949e0c5bc68ef464325b473dfbdcffce5f81e3018243c

                                                                                                      SHA512

                                                                                                      9e339f3403e8c137c628b5230ab2eab41e10a22726ee2fb069da64fda572d89740c805e5a94fb88a7e515294871fa187aa28974626114a233462894ad97f9fe6

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      b9ecdea10083d2c216503cbecd0de98f

                                                                                                      SHA1

                                                                                                      173c1621b7b55abb667163edfa270eb0fadfa56c

                                                                                                      SHA256

                                                                                                      9741413b782d74897686bf459331cd1f8833ec0d7d4f88344885ba695c2a0bf8

                                                                                                      SHA512

                                                                                                      9afc9d0daee46e8f605fbb8536de9f12810a72fe0440898faa818463bc7707934ec08f2eb4bfef379b03c22d6eb5e828c043b85e075990cb4b3967995b081946

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      746abe375587bf8f67fe2eebaa3e342e

                                                                                                      SHA1

                                                                                                      37dab9dc896c1305147cef5d0d1a9d231883d718

                                                                                                      SHA256

                                                                                                      c97ff9ab2192e595de2fb06c97fa32d783a27d9634619b965848ce8b78ee9014

                                                                                                      SHA512

                                                                                                      43ead2a332d641d6e1d4cf72f63edb68fc61332370b30799b987f45865c8debce83da4d9d70938e56e5b61291e94cc4f520cf51feff4f3e6924725484a0f636e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      f5a93b04b579c01a08a3bc3b33d7de85

                                                                                                      SHA1

                                                                                                      136dd4a2632c5ae259c43ebdc3a53f7e144dacf2

                                                                                                      SHA256

                                                                                                      e8d534c8401e7c65420ae4d4714d6d4d5d991f6a069f32b683e15ba9ea5796b9

                                                                                                      SHA512

                                                                                                      34a6763c96d435da7f26582390c044fd8bd044b843d3a07bec18faadd8c3439ffed53be819f695854bcbbf8b6a3404b155b1bec1f5fbdbce9a8ec5902f7823ca

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                      Filesize

                                                                                                      802KB

                                                                                                      MD5

                                                                                                      4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                      SHA1

                                                                                                      14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                      SHA256

                                                                                                      25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                      SHA512

                                                                                                      c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lq8Oc20.exe

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                      MD5

                                                                                                      188d5737a7d14e6694309ef4411c4ea1

                                                                                                      SHA1

                                                                                                      81c9de7a780fa86e826574c9a91725939556b8e8

                                                                                                      SHA256

                                                                                                      7eb3c784134fa10666a2f0ec06abd024a53efcc938d134d71b067bf6c6dddd87

                                                                                                      SHA512

                                                                                                      5b2ca17b4378001ce05dc60574b14ae30011385c48fe57d4a0d0a09521646cd21ddf19580ea0bd6e3461af0c56417e1ac29b305d56147e3acf76e12ea58984ae

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ss2GA81.exe

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      b651fa2cf9ba9f0cae73c0054c3a72ce

                                                                                                      SHA1

                                                                                                      e6ee1fff90d2ecbb14b5d620e2ce50e4d8a27eae

                                                                                                      SHA256

                                                                                                      83796bc5749942393d70b52600a2f2ed5b09e15a4cbae575ccd4ec3737083bd0

                                                                                                      SHA512

                                                                                                      caf33741d33a397b8a12493d46880adffb9b9668802d547554b17dc18ed0c048c0c3837ae313607c1d0a93ebcfe2266d6b4a86ea27d13bca23c74ba36a617f9f

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1ZM60qK8.exe

                                                                                                      Filesize

                                                                                                      895KB

                                                                                                      MD5

                                                                                                      593b17004f9649b2b3121e3fd787a6fc

                                                                                                      SHA1

                                                                                                      062b957942df5d42fdbca408a8aa0b3f34a09aaf

                                                                                                      SHA256

                                                                                                      b54fa1acb871238dd9551beecc6731eddec35a8a67b9fe41808a4e5af8cf538c

                                                                                                      SHA512

                                                                                                      241dc77d556d2a812c7a7e034e26465f0fafc43f86e097cc15aa173cad40247944e6c01f047e32b34cf9ab2ac67644bd1ab6c88c657be735592ad04a388ecf8a

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sM8373.exe

                                                                                                      Filesize

                                                                                                      603KB

                                                                                                      MD5

                                                                                                      09ad33bc3340bb460945f52fc64d8104

                                                                                                      SHA1

                                                                                                      8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                      SHA256

                                                                                                      a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                      SHA512

                                                                                                      2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVSWizeaX0diOuF\IQeJYY2qwFKuWeb Data

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                      MD5

                                                                                                      f70aa3fa04f0536280f872ad17973c3d

                                                                                                      SHA1

                                                                                                      50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                      SHA256

                                                                                                      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                      SHA512

                                                                                                      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tempAVSWizeaX0diOuF\Ji987kfUVCSTWeb Data

                                                                                                      Filesize

                                                                                                      92KB

                                                                                                      MD5

                                                                                                      ec564f686dd52169ab5b8535e03bb579

                                                                                                      SHA1

                                                                                                      08563d6c547475d11edae5fd437f76007889275a

                                                                                                      SHA256

                                                                                                      43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                      SHA512

                                                                                                      aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                    • \??\pipe\LOCAL\crashpad_3484_HGOYCDXYGEIYFKXM

                                                                                                      MD5

                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                      SHA1

                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                      SHA256

                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                      SHA512

                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                    • memory/64-133-0x0000000000AA0000-0x0000000000E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/64-140-0x0000000000AA0000-0x0000000000E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/64-422-0x0000000000AA0000-0x0000000000E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/64-80-0x0000000000AA0000-0x0000000000E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.6MB

                                                                                                    • memory/3324-1313-0x0000000074BA0000-0x0000000075350000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/3324-1319-0x0000000006EE0000-0x0000000006F72000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                    • memory/3324-1318-0x00000000073A0000-0x0000000007944000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                    • memory/3324-1320-0x0000000007140000-0x0000000007150000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/3324-1312-0x0000000000130000-0x000000000016C000-memory.dmp

                                                                                                      Filesize

                                                                                                      240KB

                                                                                                    • memory/3472-895-0x0000000000720000-0x0000000000736000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                    • memory/5788-1304-0x00000000008A0000-0x00000000009A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/5788-1306-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.6MB

                                                                                                    • memory/5788-1305-0x00000000024A0000-0x000000000251C000-memory.dmp

                                                                                                      Filesize

                                                                                                      496KB

                                                                                                    • memory/5844-897-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/5844-804-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/6404-436-0x0000000007160000-0x00000000071D6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/6404-571-0x00000000082B0000-0x00000000082CE000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/6404-581-0x00000000087B0000-0x0000000008B04000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.3MB

                                                                                                    • memory/6404-637-0x0000000004D40000-0x0000000004DA6000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                    • memory/6404-458-0x0000000007270000-0x0000000007280000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/6404-789-0x0000000074850000-0x0000000075000000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/6404-427-0x0000000074850000-0x0000000075000000-memory.dmp

                                                                                                      Filesize

                                                                                                      7.7MB

                                                                                                    • memory/6404-426-0x0000000000380000-0x000000000044E000-memory.dmp

                                                                                                      Filesize

                                                                                                      824KB