Analysis

  • max time kernel
    75s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 07:22

General

  • Target

    ac2af64ac3f1e92269852d8cf6866e48.exe

  • Size

    1.6MB

  • MD5

    ac2af64ac3f1e92269852d8cf6866e48

  • SHA1

    c95a63486b2d53198df10bfb0ab056e5366c5fc7

  • SHA256

    8c1bedb10049179dfe9df52eb7611d6e18ac8339b184f50a6bcbaf9a89854cf2

  • SHA512

    016b26d2f3cca6afb39f316c1c4acd5af4c18488b28ec092c975ef3613baa462e6662198e86433b217d11b599573bba34110d6ddc4b14edb05f3f7c0fc46f828

  • SSDEEP

    49152:gpTou1V6sGdPBpO9qhNgBBVvVylrFusQ:Lu1V6sy5JNmVNylrFzQ

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac2af64ac3f1e92269852d8cf6866e48.exe
    "C:\Users\Admin\AppData\Local\Temp\ac2af64ac3f1e92269852d8cf6866e48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xx3Xv37.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xx3Xv37.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rv4xE70.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rv4xE70.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4368
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cu59gI8.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cu59gI8.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4148
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
              6⤵
                PID:676
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2558412923708739175,11474684842592701203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5408
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2558412923708739175,11474684842592701203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                6⤵
                  PID:5392
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1448
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                  6⤵
                    PID:1348
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10849842663284959314,18432517777340102193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                    6⤵
                      PID:6020
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10849842663284959314,18432517777340102193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6028
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1864
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                      6⤵
                        PID:2888
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6272873561164830536,4241833987848281858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5640
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6272873561164830536,4241833987848281858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                        6⤵
                          PID:5632
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4996
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                          6⤵
                            PID:3764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14560795710998754977,7861814225249944377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5856
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14560795710998754977,7861814225249944377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                            6⤵
                              PID:5848
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:628
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                              6⤵
                                PID:632
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9572318392263407591,5776086396528788795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5436
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9572318392263407591,5776086396528788795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                6⤵
                                  PID:5428
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                5⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3848
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                                  6⤵
                                    PID:4244
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7256657954224256102,637959050098255756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5376
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7256657954224256102,637959050098255756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                    6⤵
                                      PID:5360
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1136
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                                      6⤵
                                        PID:3352
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14581322565094371970,8741032038817421943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                        6⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5368
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14581322565094371970,8741032038817421943,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                        6⤵
                                          PID:5352
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                        5⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1124
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                                          6⤵
                                            PID:2812
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16874701604337076205,16237752364273858241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                            6⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:5484
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16874701604337076205,16237752364273858241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                                            6⤵
                                              PID:5476
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                            5⤵
                                            • Enumerates system info in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of WriteProcessMemory
                                            PID:3644
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd8ed646f8,0x7ffd8ed64708,0x7ffd8ed64718
                                              6⤵
                                                PID:740
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                                                6⤵
                                                  PID:6276
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
                                                  6⤵
                                                    PID:6268
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                                                    6⤵
                                                      PID:5776
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
                                                      6⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5400
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
                                                      6⤵
                                                        PID:5384
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
                                                        6⤵
                                                          PID:7152
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
                                                          6⤵
                                                            PID:5860
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
                                                            6⤵
                                                              PID:6940
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
                                                              6⤵
                                                                PID:7112
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                                                                6⤵
                                                                  PID:5684
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                                                                  6⤵
                                                                    PID:6608
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                                                                    6⤵
                                                                      PID:6952
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                                                      6⤵
                                                                        PID:6984
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
                                                                        6⤵
                                                                          PID:7320
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
                                                                          6⤵
                                                                            PID:7336
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
                                                                            6⤵
                                                                              PID:7720
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:7732
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                                                                              6⤵
                                                                                PID:7816
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                                                                                6⤵
                                                                                  PID:7440
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
                                                                                  6⤵
                                                                                    PID:5124
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
                                                                                    6⤵
                                                                                      PID:5796
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
                                                                                      6⤵
                                                                                        PID:8180
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
                                                                                        6⤵
                                                                                          PID:5840
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4856 /prefetch:8
                                                                                          6⤵
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6388
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
                                                                                          6⤵
                                                                                            PID:4660
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7516 /prefetch:8
                                                                                            6⤵
                                                                                              PID:7340
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13755171308820816963,14533190662615722009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
                                                                                              6⤵
                                                                                                PID:2528
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2aK9433.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2aK9433.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:7488
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3gl94px.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3gl94px.exe
                                                                                          3⤵
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:7608
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:7688
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:8076
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:4324
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:4924
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 3040
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:524
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Pq9cl5.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Pq9cl5.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:1352
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:6368
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:6760
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7608 -ip 7608
                                                                                              1⤵
                                                                                                PID:1524
                                                                                              • C:\Users\Admin\AppData\Local\Temp\B91A.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\B91A.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:7960
                                                                                              • C:\Users\Admin\AppData\Local\Temp\BE1C.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\BE1C.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4636
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7960 -ip 7960
                                                                                                1⤵
                                                                                                  PID:7660
                                                                                                • C:\Users\Admin\AppData\Local\Temp\C31E.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\C31E.exe
                                                                                                  1⤵
                                                                                                    PID:5528

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06b02afc-f2e0-42c2-bcb2-abcd5768c808.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    8dc06828c1613c118f7344510eee8f6b

                                                                                                    SHA1

                                                                                                    41be52aa5464ab1f5964ca44aa1952d482ec5354

                                                                                                    SHA256

                                                                                                    893131eb43baaadce8c20bb4c4d7469a5c9c0cd71cd41bc87f8a3eb3f5bd1e39

                                                                                                    SHA512

                                                                                                    ff263b3820b92c3a9e896debfeea806cf44e4f7cb0c26a89de2a65defb45f7c2973f8294e2e9f17cbbd67af37f95c7c475c8d24e153ac36cf3a7afe613a33931

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6499ba4f-37f4-4f96-abc3-2cbaa7c68d53.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    b4f0fd24ce609de491cd116b98da1d36

                                                                                                    SHA1

                                                                                                    c5b22cdcb5af71423096ab6c09977fc97b0c7587

                                                                                                    SHA256

                                                                                                    89ffbc2367b4738521a14dc65c23cedc5e49a61da53130c21dcc55211517170e

                                                                                                    SHA512

                                                                                                    e88800b28fb6ce374b817c46be2d6e6731694fdaee0612fdb9a5d65fff39fc3274f9189b1fb2c3075292c50b1454ba637086887d3c8ad957167206cb6a4dffea

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                    SHA1

                                                                                                    8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                    SHA256

                                                                                                    d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                    SHA512

                                                                                                    6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    efc9c7501d0a6db520763baad1e05ce8

                                                                                                    SHA1

                                                                                                    60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                    SHA256

                                                                                                    7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                    SHA512

                                                                                                    bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92f3d4d9-3136-4153-8b85-f766ee27257e.tmp

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    95f8bf8eb428642280539634b562c014

                                                                                                    SHA1

                                                                                                    c8015fe4c4b79492afd75be2a87001dd91989df9

                                                                                                    SHA256

                                                                                                    717bf65a97349c52d702c20103f3e71520dca61ae9c7b145eb0081fd276f47dc

                                                                                                    SHA512

                                                                                                    bfc23648f6bbb366c6663931e4ffe6a21790091baefa6314bbec0a0a3c8fad9db9d79557e930e0ac2e32c8cded45217946f0d2187980a7764b2d487b74bde5b3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

                                                                                                    Filesize

                                                                                                    201KB

                                                                                                    MD5

                                                                                                    e3038f6bc551682771347013cf7e4e4f

                                                                                                    SHA1

                                                                                                    f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                    SHA256

                                                                                                    6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                    SHA512

                                                                                                    4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\000001.dbtmp

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                    SHA1

                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                    SHA256

                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                    SHA512

                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    3e1e3dd9cff3d6586b10eb70b7631f9a

                                                                                                    SHA1

                                                                                                    511b2d4a39e73a1dc3e15de680bc341660b960fb

                                                                                                    SHA256

                                                                                                    ac7716c48b8904b1bceb1afb02a231671e9b74bc35a9eecdc6fcd51c771bb72c

                                                                                                    SHA512

                                                                                                    f6d54616b65f80f8a592386f588f93b1eb1034496fb1508707eee5f4ef21417f1627b832662b96a2aa0e8439953d5e9cfbf1f2ce28ceb523758aca963ef5d113

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    cbf30bd938a0db6561bc6a067d471dcd

                                                                                                    SHA1

                                                                                                    22b0a215c25e660b3e1020756396e9bcd00fe7d7

                                                                                                    SHA256

                                                                                                    63e0ab93839b2f2927c3ef2f761d4c383e26c042898a2fc291cf046678a39b34

                                                                                                    SHA512

                                                                                                    3201d6cf80eb6e0b58e49528aac2f9c183c9b2f4bf4c576422a9ff75b266c99adab0ab1591d930d076766413e6c7989fe92f185a3a6d9ef60016e220fed6d8d7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe58a757.TMP

                                                                                                    Filesize

                                                                                                    353B

                                                                                                    MD5

                                                                                                    e2c39c8f33e968028b9f07f7ec75d8a9

                                                                                                    SHA1

                                                                                                    6959f33c5a182041c105eb801944b2b7505e3cd6

                                                                                                    SHA256

                                                                                                    57b9afd5e35d12d0b91e74b8f00100bb875ca3c9a37d771afbd6c4508697893c

                                                                                                    SHA512

                                                                                                    1639c793ca0326deff6c8de17eb3d346620a2ad30e7760158ee64b432b0917c0d0d0d4e0670f778d541e31ad91167183244f054bef319bead0f57ed152cd171f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                    Filesize

                                                                                                    23B

                                                                                                    MD5

                                                                                                    3fd11ff447c1ee23538dc4d9724427a3

                                                                                                    SHA1

                                                                                                    1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                    SHA256

                                                                                                    720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                    SHA512

                                                                                                    10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    111B

                                                                                                    MD5

                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                    SHA1

                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                    SHA256

                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                    SHA512

                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    d9b1b26ce4697d205646387f73e09935

                                                                                                    SHA1

                                                                                                    e9b744e35bd8ff3d2e52cfbfdb59cf8056634a9b

                                                                                                    SHA256

                                                                                                    c2518cae415bc7f221ab64bb52ca3d37f3e4f7df7bb3b66ffa06c0a11ff4d353

                                                                                                    SHA512

                                                                                                    096ec18407a2274b51b440aa756e9155d9e783ada037a1668c7621f47dff8382c912f1dcf1c3c495f33af5e92f2544ddbf03b2f0e347743a5def813aa1f944f2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    bd2afed533fcc0e2a0eef48cf8a28807

                                                                                                    SHA1

                                                                                                    36e3aa5e71421af56c1094cebb5789a3ac5a658e

                                                                                                    SHA256

                                                                                                    bceaae3f00d5637bbe7ffd9e29718b7ac527a8a0179ff7112f1cf948148358f3

                                                                                                    SHA512

                                                                                                    e5ccab4cd3ea5f1d2c5293cad1235063bc15d45f91223c3d7a233a8072edb170d34b9741fb9911cec78744f3e564799924409c6d536943c3ca89ddbb56fade1e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    638db9f8ec73c63f23a8e79c2a73e5b0

                                                                                                    SHA1

                                                                                                    c8f3fc4ef360907e52564d742967d92c20fd6e7e

                                                                                                    SHA256

                                                                                                    8fd242373ca50c18d92a1fc9a24382515475dde9b6f03c5e34824848455224bc

                                                                                                    SHA512

                                                                                                    407c11f3c71572b31738d95dcf3b352c3dc905ab9e9eeb0e38f1ea3dba4a11b6adec05da8b53bfef4b8d5a1973c89affd67c06e5ab06f469dcec5ef75114c2c8

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    0a7c26f5010550f03017829f9c559561

                                                                                                    SHA1

                                                                                                    21c4b69880b635374b1706db2271c30756b5a27d

                                                                                                    SHA256

                                                                                                    9a018a1237974728c15873f504955bb5f8119d0abbff95cd3e065e8aede37cc6

                                                                                                    SHA512

                                                                                                    9c427c7e1ad4b18fdaa6657c197c9e451aabebde5fb72f283f7ff63db5c22ee7a711f08efa982c9d38e5da6d5e5c2dffbad691e321b28699f07435e6897f093f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    MD5

                                                                                                    121510c1483c9de9fdb590c20526ec0a

                                                                                                    SHA1

                                                                                                    96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                    SHA256

                                                                                                    cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                    SHA512

                                                                                                    b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    89B

                                                                                                    MD5

                                                                                                    78ae96f8a61b4121fa0a9400bde31542

                                                                                                    SHA1

                                                                                                    556186513c5927f8d44520e25aa4c8e7284849bb

                                                                                                    SHA256

                                                                                                    ea5b16c469a1391f28d441898cdd1a630cd8fa864494a5fcf18afeb243d45800

                                                                                                    SHA512

                                                                                                    fe8c45b36a7bedee937e12871567381f66e4b4881d15853382168606f77579ebecd8fdd1df4ea958feff91216a589bd069ff64afd6f873108c6a058c5f0e8cc3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    146B

                                                                                                    MD5

                                                                                                    041a088555a96f1c606d618c224b491a

                                                                                                    SHA1

                                                                                                    9ae89fed6da1d0f26facfc12d651d929e6522915

                                                                                                    SHA256

                                                                                                    eb8e8cc8d5228f6e047784b9fcf3e27ad49d3e126b14a353eff34296f10ed31c

                                                                                                    SHA512

                                                                                                    b62c3367ae0d6717f54e4280929b7959e0c9e56622e316daf6ecc39b1c631dea7c32dcb3bd521f9024b04c343e4d15425d8386bcb7e66ee7a928e9624d7b950d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    82B

                                                                                                    MD5

                                                                                                    e2f414c3831ca558643bd1c9a2ff1c62

                                                                                                    SHA1

                                                                                                    869dcc9893c1afa8aecf3fc9e21922d6c8f09b7b

                                                                                                    SHA256

                                                                                                    47cc2a1e5a37c1b926cb0cf6b9d9716cd5b7d17f44d2a34112bdb91cc412ad8b

                                                                                                    SHA512

                                                                                                    885e03d18da583e734334581924b66f87ba4ecaa213d6c718797fedd1d4dcc408c13f25bd5c4f5ac6773a35ea32eef1d53f9cb58072207a823e0c8d811b8a596

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                    Filesize

                                                                                                    83B

                                                                                                    MD5

                                                                                                    380f4327a86367b33cd7b485c4576d62

                                                                                                    SHA1

                                                                                                    b0e2dc33bcd99d21963e23a52145460cf0427ec0

                                                                                                    SHA256

                                                                                                    1e5beac71d8c163c155ec61cdf9e8fb7fc95a2feea90bcded7771f74c2e4f068

                                                                                                    SHA512

                                                                                                    15b07a48a9bd832c6a2374fa020eee82564edb2a9e407554d347dd99f05eb22ee0e7642bc121277c1bff7011ae70e55489bcf4f88314b9da7fabef68ff4138b0

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    10e3e3fd4a7ab47068e35c08d31448f3

                                                                                                    SHA1

                                                                                                    0aa127a6281344e925da07fdabe86deb5af0a380

                                                                                                    SHA256

                                                                                                    71cdb876c106c1d9997de624842c69e2b0286214a122de4f103e0ad537c8446b

                                                                                                    SHA512

                                                                                                    933c840446df8bfef9af817454cb79d27c111a3c839711881869aa50f98004de73c728be55629c0eb4af70209758cb702fc3f1b147f3a2d1009d557664c5bdb7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    4676b824463afc3b2694e74757ae282c

                                                                                                    SHA1

                                                                                                    fb819ad88a7eb2cd96f931db4a5294ffbf453014

                                                                                                    SHA256

                                                                                                    c1193a110a315f737f9c8a89fbd18c73199a57da98437c75ce88556f7857103c

                                                                                                    SHA512

                                                                                                    b70f549f675573a77ab38ae5b89838a0bda12a0b306912dc5d5a96db84384c383149a2e41fd6fc1536031a6437647660751f4dcdd71caef9ce736ca27509a17d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    e488c68bad3070f2e52bb1adde04dfc6

                                                                                                    SHA1

                                                                                                    af83ae8cf6e5f7cb97a3e68347ce48d8589bc171

                                                                                                    SHA256

                                                                                                    a8a2494a3b45dbd1f1ed8e298fc4dbbb763bd10c874f2216312b0fa9944a7485

                                                                                                    SHA512

                                                                                                    739380c87c357fb7088c9dde4f40429c6be7735459969838aeef9adc1784488f51b9420ef2e756a21e322c5c04f378a2219a1e4f74d016563b835e77c671bb70

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581f1c.TMP

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    edc038f7240b09a314a4b07958e7cc64

                                                                                                    SHA1

                                                                                                    6f7527597c89985a31ab603c7ef8215fa6b202e6

                                                                                                    SHA256

                                                                                                    64983b4e354a2c38e8b1b8be4f6509e86b97b1f6788a5ad695a2ccbc1b85fc84

                                                                                                    SHA512

                                                                                                    81f082b7f1ccb7b2bc75c4f74d546d3f72ea19a0b60877793547fd62e476846c63072665dec28b86fa9febc628cdadf12c4e8cfbbd1e785e115c90f0b77d070a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                    SHA1

                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                    SHA256

                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                    SHA512

                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    e91594c25629d39e2ad4a564a1fd5b3d

                                                                                                    SHA1

                                                                                                    4e13687788ea5970e2b02557f5d38be71412e252

                                                                                                    SHA256

                                                                                                    18aca8fff95224a10f809594c835c97dfaba377d32c8e91ae60d7aaca43d0e23

                                                                                                    SHA512

                                                                                                    c89e3f326196d3789fdeaf8be54e601e99aba1534dcffeb29d4335b393c22d4d155db89fdf0d9cc25fa18549a14d464c499e45af07ea0fa135dde9088cc1ece9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    891769e475b8d524836e7322b573154f

                                                                                                    SHA1

                                                                                                    4c8276c7544bb83eb04ee5c1ee0b4494b4035604

                                                                                                    SHA256

                                                                                                    0293787e8195e2ffee5d521396bd87a3529fd4ca41e198bbdeb894743a78b92c

                                                                                                    SHA512

                                                                                                    3044aca7353dc95794a5f602d2c5c414b36d2fbdd383b87880f5eae34034d699af41d83b91bfa51957dabf495a3b9cef429030976cab2b2bae29e4c42ad2b688

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    e8577c6b2e742a7cda5e593d5a83d9ad

                                                                                                    SHA1

                                                                                                    2d6fc60f7c078ae4b3d3a52dc2d7d582d2e841a8

                                                                                                    SHA256

                                                                                                    ff93309fd1b9917a8e174b3fc2a25b8d6f7cf19f6790cb2fd165a1d3eea145fa

                                                                                                    SHA512

                                                                                                    5e967ba128735e2ba5d4dc679ced6f9199557e7af49e297da7f3b4dddab8052a278dbe5aaa0fb9eaff02e508b29d95872393327939a01bb66fd874c51cac7db7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    ea16b7c0d653ef7086986d96b04e4370

                                                                                                    SHA1

                                                                                                    42c851ee2fd079395cbd8a67a130282d623b8b58

                                                                                                    SHA256

                                                                                                    e9cc00d19e9ddc0d35a54e58c153750a0f2bf723b26f5a1daa4a72dc7c461a65

                                                                                                    SHA512

                                                                                                    fe06c0711ee88d22501bd7b2ac8cab8d8649c3d912407b8e5323c0f8ff6356ca412e0d54b3e136d4119ad6e97cfc045fdd3c6f1af362f85b8a4186df05d651e0

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    1fe4e447edfbfe6bd91f95f28b2ac4df

                                                                                                    SHA1

                                                                                                    6beca4fc6ae22ed001ffa61f45dd665299b96098

                                                                                                    SHA256

                                                                                                    3514d1fc2b55dddd465fcded82ac57769e27a51d6c1511cb568bbb0d92c8c5dd

                                                                                                    SHA512

                                                                                                    3a9b7864010f477b806cc0d4e7ed88a8ea9c01627ee7698bc29dddee4ce5e1edece71f1157a99b0ae7170b2c2aae607035cfc3c28d14816537d44eb6cba2575a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d922c355-8325-49d9-877a-12db443a978c.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    34a70b12a06820174f81100176d65342

                                                                                                    SHA1

                                                                                                    d49a3ab705cebfb160933fdb1fec70eb5e1576d6

                                                                                                    SHA256

                                                                                                    ca4e80ee03cef870b3d078b8649ee4d5e7a53975cfe2e5d8ffe59443c3c8470b

                                                                                                    SHA512

                                                                                                    0a13eec8ecb691dd29478429006518b07f447ad443be13a7a9f5dc834d3c64a0da57b92cbe3eae9ddc4c02ad1ad1ebf27de1917cf69d6fab0e03993f5f84b492

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fbb89fd5-ebf3-43ac-993e-d37be102d98c.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    6ee4b80352a478953800333efa772763

                                                                                                    SHA1

                                                                                                    9f9633390140a140f45216e69266674ee3c1ace3

                                                                                                    SHA256

                                                                                                    3c1b29da427c1f8efb273052668f1f955a277a58a642289df2d906777f1a1143

                                                                                                    SHA512

                                                                                                    0606d9e27fbfa28dd9872069165a64cd911082b8728ea2122d33515be418c934ad09a78a4216120fed64941b7487c2666434bb324b3b0bdd5996c0096356ad20

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                    Filesize

                                                                                                    802KB

                                                                                                    MD5

                                                                                                    4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                    SHA1

                                                                                                    14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                    SHA256

                                                                                                    25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                    SHA512

                                                                                                    c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xx3Xv37.exe

                                                                                                    Filesize

                                                                                                    1.5MB

                                                                                                    MD5

                                                                                                    120e4b78d99d89a110ec5b4bd5794009

                                                                                                    SHA1

                                                                                                    3442b624241ec0b3b55c42c9a09c56b10ee22420

                                                                                                    SHA256

                                                                                                    2ee264ea23c585106d121bf2af9cd96ddf81027513e3d8fa958102666b9e3dbf

                                                                                                    SHA512

                                                                                                    ba626730888dd8f0ad1fd701be6f0f825109e598a5002b16d853da3ff7137504dd1d14694466aa40e8ac810d323a5598c00b088933547d8d67ebcd66bf28fe9e

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rv4xE70.exe

                                                                                                    Filesize

                                                                                                    1.1MB

                                                                                                    MD5

                                                                                                    016976806b43bf8cd6d1f9aabcd29a7d

                                                                                                    SHA1

                                                                                                    732d4721c42e1ad852d909e9b92b1e721048212a

                                                                                                    SHA256

                                                                                                    9d39d997fbed8bfb3cb32db06c4ba27d67a53d7eb9f264bc16097220a1e076f5

                                                                                                    SHA512

                                                                                                    db71c61500f435a65d186b5e67135962a2980e27276017741711bd9ff329f63c21c584e4e373761f45e4c66eac5c87641c984a135d5be56c86456436dfbe9c36

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cu59gI8.exe

                                                                                                    Filesize

                                                                                                    895KB

                                                                                                    MD5

                                                                                                    313c3fee19af39ef4dff670033957a50

                                                                                                    SHA1

                                                                                                    d8047f88e51e0e4f8c59156405012d02821b551e

                                                                                                    SHA256

                                                                                                    8b3486ad38c3b62caa2c3c8c36bb3c04f21748c1c45952c0afb0652a4ca48b4b

                                                                                                    SHA512

                                                                                                    550b5b6bc9c2f319e8199421b175ba739d8a92d1e947373d67dce1b0bc05d7de87c29c56c23957881a83757ce3ee88ec5ef5675af557b802d71fbe17e4a569b8

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVSRXhuSHeI6RfI\Hwk0xOCC1xsJWeb Data

                                                                                                    Filesize

                                                                                                    116KB

                                                                                                    MD5

                                                                                                    f70aa3fa04f0536280f872ad17973c3d

                                                                                                    SHA1

                                                                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                    SHA256

                                                                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                    SHA512

                                                                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVSRXhuSHeI6RfI\cKiI6tJlI1xWWeb Data

                                                                                                    Filesize

                                                                                                    92KB

                                                                                                    MD5

                                                                                                    ec564f686dd52169ab5b8535e03bb579

                                                                                                    SHA1

                                                                                                    08563d6c547475d11edae5fd437f76007889275a

                                                                                                    SHA256

                                                                                                    43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                    SHA512

                                                                                                    aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                  • \??\pipe\LOCAL\crashpad_4148_JSFLQCBJYNZGPTSW

                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                  • memory/1352-929-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/1352-906-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/3552-927-0x0000000002BA0000-0x0000000002BB6000-memory.dmp

                                                                                                    Filesize

                                                                                                    88KB

                                                                                                  • memory/4636-1537-0x0000000000570000-0x00000000005AC000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB

                                                                                                  • memory/4636-1552-0x0000000007350000-0x000000000735A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/4636-1545-0x0000000007340000-0x0000000007350000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/4636-1542-0x0000000007370000-0x0000000007402000-memory.dmp

                                                                                                    Filesize

                                                                                                    584KB

                                                                                                  • memory/4636-1541-0x0000000007880000-0x0000000007E24000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.6MB

                                                                                                  • memory/4636-1538-0x0000000074C90000-0x0000000075440000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/7488-425-0x0000000000020000-0x00000000003C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.6MB

                                                                                                  • memory/7488-656-0x0000000000020000-0x00000000003C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.6MB

                                                                                                  • memory/7488-366-0x0000000000020000-0x00000000003C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.6MB

                                                                                                  • memory/7488-426-0x0000000000020000-0x00000000003C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.6MB

                                                                                                  • memory/7608-659-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/7608-664-0x0000000007B10000-0x0000000007B20000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/7608-660-0x0000000007B20000-0x0000000007B96000-memory.dmp

                                                                                                    Filesize

                                                                                                    472KB

                                                                                                  • memory/7608-904-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/7608-658-0x0000000000D00000-0x0000000000DCE000-memory.dmp

                                                                                                    Filesize

                                                                                                    824KB

                                                                                                  • memory/7608-720-0x0000000008C30000-0x0000000008C4E000-memory.dmp

                                                                                                    Filesize

                                                                                                    120KB

                                                                                                  • memory/7608-726-0x0000000009120000-0x0000000009474000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/7608-789-0x0000000005700000-0x0000000005766000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/7960-1518-0x0000000000B20000-0x0000000000C20000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/7960-1519-0x0000000000A40000-0x0000000000ABC000-memory.dmp

                                                                                                    Filesize

                                                                                                    496KB

                                                                                                  • memory/7960-1524-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB