Analysis

  • max time kernel
    62s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 07:48

General

  • Target

    9c7401e5b3991543263c86a1b7e459f3.exe

  • Size

    1.6MB

  • MD5

    9c7401e5b3991543263c86a1b7e459f3

  • SHA1

    6af4c5448ddfc83e711f11c8a0f6634eb351753b

  • SHA256

    c1ffd458cc441fe5d967825862acbc540728517d0f8ec95621bd6edd1a724767

  • SHA512

    08a6897837128c221d00ba4fb301dd8809dca0f9cd0f2c19b2b7874a819cd506be4ab61b44a46c85254496986c43e5d6e41b9b367e2473cc34fa1488c4ae31ff

  • SSDEEP

    24576:YyN9xh58retHiYAJGnlk7VtGwxK5xlIRmEw/DCpNrrsCvaWHzEYJiEjAAK+R:fDxme8JGifGGQEi+pdsIEOT0U

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c7401e5b3991543263c86a1b7e459f3.exe
    "C:\Users\Admin\AppData\Local\Temp\9c7401e5b3991543263c86a1b7e459f3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:908
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x150,0x174,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
              6⤵
                PID:3708
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15554861085979194338,7170198673759020486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5496
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15554861085979194338,7170198673759020486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
                6⤵
                  PID:5476
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3044
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                  6⤵
                    PID:1540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1063284842944732891,896375222604617845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5468
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1063284842944732891,896375222604617845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                    6⤵
                      PID:5460
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2492
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                      6⤵
                        PID:3232
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6017243247885820544,8709044580904785560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5612
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6017243247885820544,8709044580904785560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                        6⤵
                          PID:5604
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        5⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:1204
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                          6⤵
                            PID:4156
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5428
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
                            6⤵
                              PID:5420
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
                              6⤵
                                PID:5724
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                                6⤵
                                  PID:6576
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                                  6⤵
                                    PID:6564
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
                                    6⤵
                                      PID:7136
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                                      6⤵
                                        PID:5776
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
                                        6⤵
                                          PID:5500
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                                          6⤵
                                            PID:6008
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                            6⤵
                                              PID:7288
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
                                              6⤵
                                                PID:7300
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
                                                6⤵
                                                  PID:7452
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                                  6⤵
                                                    PID:7464
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                                                    6⤵
                                                      PID:7696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
                                                      6⤵
                                                        PID:7732
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
                                                        6⤵
                                                          PID:8068
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
                                                          6⤵
                                                            PID:8064
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
                                                            6⤵
                                                              PID:8080
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8036 /prefetch:8
                                                              6⤵
                                                                PID:5164
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8036 /prefetch:8
                                                                6⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:7704
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1
                                                                6⤵
                                                                  PID:7196
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
                                                                  6⤵
                                                                    PID:6764
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
                                                                    6⤵
                                                                      PID:1596
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7392 /prefetch:8
                                                                      6⤵
                                                                        PID:6024
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7252 /prefetch:8
                                                                        6⤵
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:6032
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1312 /prefetch:8
                                                                        6⤵
                                                                          PID:3184
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,17035094298575521938,12978469927326473671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
                                                                          6⤵
                                                                            PID:1448
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                          5⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3416
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x164,0x174,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                            6⤵
                                                                              PID:4716
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,15725535481681558603,10504883216085969426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:6488
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,15725535481681558603,10504883216085969426,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                                                              6⤵
                                                                                PID:6476
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3080
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                6⤵
                                                                                  PID:1620
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,1551472421647293353,4976503400715512848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5812
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,1551472421647293353,4976503400715512848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5804
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1876
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                    6⤵
                                                                                      PID:2452
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16462704615559794826,4583668713324628267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5772
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16462704615559794826,4583668713324628267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5620
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4844
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                        6⤵
                                                                                          PID:1380
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2692465906106070488,7354992779358569452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5780
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2692465906106070488,7354992779358569452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                                                                          6⤵
                                                                                            PID:5520
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1856
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                            6⤵
                                                                                              PID:1308
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,578620849135493597,15609959190198078912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5796
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,578620849135493597,15609959190198078912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                                                                                              6⤵
                                                                                                PID:5788
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2qc8602.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2qc8602.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:3364
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aJ56bK.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aJ56bK.exe
                                                                                          3⤵
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:6176
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:3260
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:5368
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:7940
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:5900
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 3108
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:4880
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CC9PD7.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CC9PD7.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:4072
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:6692
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:6640
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6176 -ip 6176
                                                                                              1⤵
                                                                                                PID:6584
                                                                                              • C:\Users\Admin\AppData\Local\Temp\A340.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\A340.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:6760
                                                                                              • C:\Users\Admin\AppData\Local\Temp\A4B8.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\A4B8.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:6592
                                                                                              • C:\Users\Admin\AppData\Local\Temp\AB02.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\AB02.exe
                                                                                                1⤵
                                                                                                  PID:6452

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\673cb441-0a67-4622-bab4-7e38101e5292.tmp

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  a15c0056cf8a3c8cefea5239931cae07

                                                                                                  SHA1

                                                                                                  d7be0fbf5ef2425becfb1f102c895614813c7cf3

                                                                                                  SHA256

                                                                                                  2c0ad23f42622aeeae5a7c490938089b86f52a37d426f0dfc6c77e9a9d8991d8

                                                                                                  SHA512

                                                                                                  fd39d6292fb9ed91b3437b150ed0df92080bc7b66b40c5749b5943cc3b3a5b64d7e3a73023aec9b62cf9e4dc3c187adec93a7a9cbb83e2153044a3d46faf01a5

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                  SHA1

                                                                                                  8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                  SHA256

                                                                                                  d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                  SHA512

                                                                                                  6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  efc9c7501d0a6db520763baad1e05ce8

                                                                                                  SHA1

                                                                                                  60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                  SHA256

                                                                                                  7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                  SHA512

                                                                                                  bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

                                                                                                  Filesize

                                                                                                  201KB

                                                                                                  MD5

                                                                                                  e3038f6bc551682771347013cf7e4e4f

                                                                                                  SHA1

                                                                                                  f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                  SHA256

                                                                                                  6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                  SHA512

                                                                                                  4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                  SHA1

                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                  SHA256

                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                  SHA512

                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  396B

                                                                                                  MD5

                                                                                                  5b7ae5fb7e90381a9b15cb6d7c865498

                                                                                                  SHA1

                                                                                                  93f725711b177b3a93250808cf2bf37172e9b537

                                                                                                  SHA256

                                                                                                  593e94afbcc13f73c948c9403943e15dc7dd863da5558bcfa10409e8cc721a47

                                                                                                  SHA512

                                                                                                  69de4f8140175535837c7f5ddf4f7d87b3c18f58903d3807aa7197d4ebf5328f29cba831cbbfb41de80f0be90f6925ef6b8f9609276574c96f298c05d23cc5ed

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe5894b9.TMP

                                                                                                  Filesize

                                                                                                  355B

                                                                                                  MD5

                                                                                                  e13a08abe67f1f5f9329dffe3e0c1680

                                                                                                  SHA1

                                                                                                  04e661a58df9456f84e0ed5393ccdba32406be6c

                                                                                                  SHA256

                                                                                                  02efaa7e60b8a623a8e5dba28aaa9852874b790c8aa643a6845bd639134644dd

                                                                                                  SHA512

                                                                                                  f0487de3692ce39c11aba7c54372b6aac51fe06695b82ab870527a534b09331367af16621cb714f2340999c6c52e3793c58e3844ab45541b40a11d86bb38a11c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                  Filesize

                                                                                                  23B

                                                                                                  MD5

                                                                                                  3fd11ff447c1ee23538dc4d9724427a3

                                                                                                  SHA1

                                                                                                  1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                  SHA256

                                                                                                  720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                  SHA512

                                                                                                  10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  111B

                                                                                                  MD5

                                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                                  SHA1

                                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                  SHA256

                                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                  SHA512

                                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  3cab143bca30223be5c3dd3566e2840f

                                                                                                  SHA1

                                                                                                  3f028069cc77398816757d7a246be09c41b85057

                                                                                                  SHA256

                                                                                                  55fe946480ff030474fb7bcb262b4a9e6f375a4ccbe3eb71307441aa7b1cfff6

                                                                                                  SHA512

                                                                                                  d8747ce8cb8a8387066704a16b815b1cc482a4a7f22258e3a378fd8e546c8b63f3af811c58e460fd65f2d1688067310c400da2b06f0a62a64c13f0ec721d5e1d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  4ace5ddafb40d2e592b29c259603fd2b

                                                                                                  SHA1

                                                                                                  2c6d89630445ad0be514b66f3dbacbc7728f3ee2

                                                                                                  SHA256

                                                                                                  64fa1fa5ac0f6b2d260f37d8e4120107774bc271f0824767940bb32d2c8a3fe9

                                                                                                  SHA512

                                                                                                  f3f6f0e0d8e16378be2a83e1ca85700cbca80319cd3c65e4689c5eb7f9c59de96e1fdad7170cffac256503d9f965896b144331ee752a305c9e1b033287f42598

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  e121a6483b9bc898f69a23d6e6503a16

                                                                                                  SHA1

                                                                                                  e9df6615b69271c8687be61d3f0de1cfb9ca7e50

                                                                                                  SHA256

                                                                                                  738c5a31cbd54e83cbac832126eb74e89dd6b79011fbe34183c27b8fdcd41f66

                                                                                                  SHA512

                                                                                                  76e0f62bcc71c8343f0419affde19d35473aae3f00b324172058d9c46c57aa760cf8fdc2f6c092f05716e39c81a2f322d2966193dad55511e5c7d59ee8ab900e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  6d1c302fc891613cb9c4f43f31418b79

                                                                                                  SHA1

                                                                                                  352e6e1c4b931d27e9fb686cd823c6c943a304a4

                                                                                                  SHA256

                                                                                                  687ce6f4ee43acee658686579fbc0d8f40b6276a5bd2c2b77624d1caf3acf352

                                                                                                  SHA512

                                                                                                  5a7b814415ec7275b3a30cc459669eaef214a61c55c74b3060ccf274e82187c00e09d23c2abf0217c965f0ef0a01f6b2f426fe92f2661ba0c6196de97d5724ee

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  MD5

                                                                                                  121510c1483c9de9fdb590c20526ec0a

                                                                                                  SHA1

                                                                                                  96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                  SHA256

                                                                                                  cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                  SHA512

                                                                                                  b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  89B

                                                                                                  MD5

                                                                                                  6b440f8549e9c9cc81e2847085ce7cc3

                                                                                                  SHA1

                                                                                                  094726f64ff54f157d5a96fb9336e2058f6e44c9

                                                                                                  SHA256

                                                                                                  05d9aaf6a411f417898889ac2942202cca5f77c878bfc2bb5a2734f1b9873bf1

                                                                                                  SHA512

                                                                                                  ab3c6fa7e0fc171b5526591fac5fb171881999236e9fcccf6b9c37cb838812b04db917b425d2b27066601c440e7a137fdf1bc3c5783eec7d6916299a748ca4f3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  82B

                                                                                                  MD5

                                                                                                  8ea162fb166fe1e8ece06aa87818ff41

                                                                                                  SHA1

                                                                                                  325a1d810750bb0c32077ccce832b28bf62882a2

                                                                                                  SHA256

                                                                                                  cf846f0d3e32c41d19fd0023f931417a688cf84a896c71cc7d26d160fcffd52f

                                                                                                  SHA512

                                                                                                  45191ebc707dc5c8637cee38461dd3277bcc28cd1a515adaeea462e3c2aebd916b4f69ecc217b3f9c38a84eada8001802b79e80bbeee99352f199bd3bb16a615

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  146B

                                                                                                  MD5

                                                                                                  4eb201947134a5cb3793afd97288327a

                                                                                                  SHA1

                                                                                                  7f2a42e182705afc5f7f19bf318f0687a863b421

                                                                                                  SHA256

                                                                                                  8ac2a2281d24168ff7cfd12dc4023b69865266376ae5d66080d7459d96ba1b5a

                                                                                                  SHA512

                                                                                                  3c159b57b8a68bd79e2db9499918a469fb5ec2b46c4e28f98f1009a52413241743d2fd893c2efb1c06cf5b192e5c9f5bb008afd893c8657e5404980c2a021761

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                  Filesize

                                                                                                  83B

                                                                                                  MD5

                                                                                                  d4cad51c092c4e77aa0a3b0ca9207f5d

                                                                                                  SHA1

                                                                                                  ed93eff43302c0f7dda1d4679f7ef1471277dc73

                                                                                                  SHA256

                                                                                                  36d7f87985c2157821c458ef92212276c8ed8836ccceec0fcbe9076e3f9aacf3

                                                                                                  SHA512

                                                                                                  c7a80b6e75db8e04d662b24b90a83e7a63098bf2ddc7407b7793ba6e59c0adb46e5ff8c6b6f06575aa695ef7467dc04daade8a8b7ea8af28d2735a82ab36cc98

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  61e9ef9871be48077cb9f41416597a0d

                                                                                                  SHA1

                                                                                                  b5b0d4922d41c8fefca6d19aec58839946a51170

                                                                                                  SHA256

                                                                                                  8ca6cc3e7a9f784bb044e272cffd2f60044ab008c0f49a55fba33cb5bba5ba51

                                                                                                  SHA512

                                                                                                  00dfd760d0f9822217ecd0b941b1b6f45e28d0013c9a245fef45400de1f1524d108cef91cf16ac121813d913cae71156608f6e2a80ef97c19867067ead015fc2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  44fdc1d775306e0284396fec92f37fe2

                                                                                                  SHA1

                                                                                                  6edfca2db1b507298a180fc745e80717e931954d

                                                                                                  SHA256

                                                                                                  8b24928662f7232ea9e8eda5e96cb8b21f54175a5504573d5d66c4dacc2a22af

                                                                                                  SHA512

                                                                                                  23678985ef0f68f1c8a0e4858a8b4d12ca9f366999d28e2f29fda414d86796e6291043a232ed4c3d5c44d3370890aa156ea20c458ccd2f7727d28abf9ab3719e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  f1e69fd530f3e541db9f7a95aaaf670a

                                                                                                  SHA1

                                                                                                  d96241820cdf931908822f9bf030043ecbc21541

                                                                                                  SHA256

                                                                                                  193e4d7682f1e9fbe3848f16ed411451b429c374f0a00ccd76ccd0bcb7ebc39d

                                                                                                  SHA512

                                                                                                  c10b2b420da14dbc669241b46308244b688305c07983a0b025998f4bece59107e130f73fe037e1bd587373f75fbcbb80fb5973d9b1a90c0a0cad581e4b4fb581

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583fa4.TMP

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  483c4e3edd349ba2f621bf4b80802638

                                                                                                  SHA1

                                                                                                  8511a8830661f7102a4f76e04efac8c8128ff552

                                                                                                  SHA256

                                                                                                  0516be5a48b209ed6fa63ece3c93d2960e81b55a2e034dcad2fe04021818a625

                                                                                                  SHA512

                                                                                                  0326a95f63e01e3cde68bfc77446588bb3d9098b8563bd0e63293b02b68922a7fa735983d47bfd2b81ca08d582d456766498d41f288ffa0aa9484cb8cbb2bf2d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                  SHA1

                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                  SHA256

                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                  SHA512

                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  eec8e8c7bd58c501f65c571589456ad6

                                                                                                  SHA1

                                                                                                  4c0ba2ed6bc46f78270ddd9e1728315bed855a44

                                                                                                  SHA256

                                                                                                  872fe98214d996f7b27f0ce0b528fa25dc620d5209b6030d0f62aff2b0c080c7

                                                                                                  SHA512

                                                                                                  82863f34d95a733094bb39672c163d0469052176594e38c119115b61b21c94d99f1dbc5754fcdee7c5acdeda5f95c3196634b9e97f58b83078ef7a7f649f9470

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  3bd360259c20a0df939f22cb6c718d80

                                                                                                  SHA1

                                                                                                  0152a7beff6e67567dbdbb74d80a5f3368901ae8

                                                                                                  SHA256

                                                                                                  e79c4880d859bf961c26e5875893c7d2ad2ee63f3a3fe547f997b4b1ff1896bf

                                                                                                  SHA512

                                                                                                  4dcde63545e0fcbcc1b024a3c3852dd063372edbac3b00cfb035a0ec064496a0dec9932b301eb067ba5f8f1bcb8998a0576c74da87fbc80f9dfb2fb8424d4c7f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  ae5adf138fab840bc28929d97d700289

                                                                                                  SHA1

                                                                                                  6fcac63b215d8a50968a15e258e3ba7a5358034a

                                                                                                  SHA256

                                                                                                  c9cfa083d0f56e771fae4cdc444bd49e9de6e562fded5d42bfa440008dd2ffe2

                                                                                                  SHA512

                                                                                                  edbfda60c82708bce8c6ac336247628fc63f50f53063c6b4772d805fd4dee900a0e66820a0e6bfdc489b2f8952443c72d4145c03399f82f8ff4844109a8cc13c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  c94c44b2ff8a77b777a8ffe9719a3afa

                                                                                                  SHA1

                                                                                                  dc4f0fbe95e8a98530a1123fb38a19945684fb61

                                                                                                  SHA256

                                                                                                  86d172280deb1ada1755bb2c0d0f52139b896d6d56be50bbdb0458caad8f7527

                                                                                                  SHA512

                                                                                                  4c83ff299a74989690aea579537ab3642e60be573aa1f44ae7cb5747b9fbffd5c19850629fb5b963d0acf57856e8ca4ab6bd50d2e6222046241898809310c77f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  5f3b4f54fe576ac558c77de53e211c3b

                                                                                                  SHA1

                                                                                                  dd934c9fb56f219eec640b445f1a13688a2eed1a

                                                                                                  SHA256

                                                                                                  56583b51ca06e74843f79afd39c2760e6852d9c37fe543b6133230474bee6006

                                                                                                  SHA512

                                                                                                  bb259a3aea7d8f29e2ef98a3517ce114a858e1e4f135ccde875608395836909ce857f08162daadfdb23de6d25bea052bb0a16c04caecc7f883dcc0b25ff99b33

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  6d69fd4836b3d308bea374aad127e8a6

                                                                                                  SHA1

                                                                                                  e1082a7cbb9257d8c9408e4d0983a1c762772810

                                                                                                  SHA256

                                                                                                  1f3d651a5bf0346a2de95c0fa4488285a4bd4f0c558c36b393dc2468df76431e

                                                                                                  SHA512

                                                                                                  8b268ec92eed678a7b182b03d5ad2c067d17b35f3dac2b89b2f8f43f478a4e5e77ead35cefba9b5c9df13f16c8d5bf1cec63abcdc91762086e3081eeb5b41af7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  248ccfc38602f9582cf726e97ac5e608

                                                                                                  SHA1

                                                                                                  08d3ccb5cdde6f228ba21712b6cbd6e340cbf4ee

                                                                                                  SHA256

                                                                                                  c681cdc44527194afc51c05659158ebfae42e9da59ff3109083e6813246dd5c2

                                                                                                  SHA512

                                                                                                  6cba28d950595f3c4663b7df020c4ae6556628ded0c7f5ecd90515aa31c54af26d9fe993ebfed6f2c7b1b5711f90d3e24a82f820ccf2bddfd028a6454c8bb55b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  c4cfa5c06471a2751b878ea2a5db8efe

                                                                                                  SHA1

                                                                                                  4f2a96cf8fc9178fffbf253e5a233adfa395624b

                                                                                                  SHA256

                                                                                                  662974fcd36381bae5e13b673c942c27bb91e6c3f8afe806299cae69eea3c843

                                                                                                  SHA512

                                                                                                  38a75ef506d47f27b5440036ea10ad0f241b0a06e98670c616f08c2ce7131d85eadeb077fbda726b2e7f95a192c81c530b460f2b2d7cb90c3bc5cc7d33b2646e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d109800b-f14c-42e4-a30f-967a459906b9.tmp

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  75b19ed644aa68a7a8f31d71fc05fd27

                                                                                                  SHA1

                                                                                                  3758f7cb3810769a5065e119f787f8dd90153bbf

                                                                                                  SHA256

                                                                                                  8496246f09db3897a6fccef4eb889fe1d6c7c52cc1b3dcf40c670d67d86ab3a3

                                                                                                  SHA512

                                                                                                  f4aa29aa731d5a40260c855a2684d9da3f1843dbb89d3100e54597a0653dc046a94d5160a81ebf1e08ca5429108ac7e05cfe1c47a85f465a872f28f6b147e447

                                                                                                • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                  Filesize

                                                                                                  802KB

                                                                                                  MD5

                                                                                                  4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                  SHA1

                                                                                                  14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                  SHA256

                                                                                                  25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                  SHA512

                                                                                                  c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  MD5

                                                                                                  fd995fd4c77510bdc96abed2328da9a0

                                                                                                  SHA1

                                                                                                  e582c2c6b53ce25951678ab3ebe7b3f2e0defaa9

                                                                                                  SHA256

                                                                                                  df8c8a5bcc42f55b2a53c893302ceba939bdeb7e171145de9076512600be4eae

                                                                                                  SHA512

                                                                                                  338e258c79905f17916183bbc639eaa00ad096e222187f29f128d17eca60a3c354c1c2ad271e9dddf6017c2ee291cee6681d6a64dc9829fcfd8a9f65fb173f38

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe

                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  63ea06d9a0f6e1986edddec56d1ed96c

                                                                                                  SHA1

                                                                                                  698bcab0f605e7f0406056005f177e7ef75800fd

                                                                                                  SHA256

                                                                                                  71c0e948518a8f2729d1f495815c7bd7a09bef19b4f4c9375a80cb22345d7c36

                                                                                                  SHA512

                                                                                                  434d3afb667c5f1f2a2777df0820d8f84abd8460239010ac8a64af7f47b248a9ae561fded5e8e1ef2d4ed77d4b7cb2538a7e051640689b6e16ebb93dc9788897

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe

                                                                                                  Filesize

                                                                                                  895KB

                                                                                                  MD5

                                                                                                  9411aa64fdc6b8e8558b9fe8bda63795

                                                                                                  SHA1

                                                                                                  99800ce89efd412df440afd2342cdd240882f25e

                                                                                                  SHA256

                                                                                                  078da73239ce54f75b116fa2a6b1623ca10adf18f8c500625236e147456df588

                                                                                                  SHA512

                                                                                                  c3737f489d09e114af4a20dfcd523e3ed71d460f056dc06289a96da5a8d067dc17ff527828d346aa3e05741215c6a5a407bb05f69cdd620ba46835983fe04927

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2qc8602.exe

                                                                                                  Filesize

                                                                                                  603KB

                                                                                                  MD5

                                                                                                  09ad33bc3340bb460945f52fc64d8104

                                                                                                  SHA1

                                                                                                  8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                  SHA256

                                                                                                  a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                  SHA512

                                                                                                  2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                                • C:\Users\Admin\AppData\Local\Temp\tempAVSOnXrhDsfa1Xw\liuIoPtHgzxmWeb Data

                                                                                                  Filesize

                                                                                                  116KB

                                                                                                  MD5

                                                                                                  f70aa3fa04f0536280f872ad17973c3d

                                                                                                  SHA1

                                                                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                  SHA256

                                                                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                  SHA512

                                                                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                • C:\Users\Admin\AppData\Local\Temp\tempAVSOnXrhDsfa1Xw\uPg0JwppY9P4Web Data

                                                                                                  Filesize

                                                                                                  92KB

                                                                                                  MD5

                                                                                                  ec564f686dd52169ab5b8535e03bb579

                                                                                                  SHA1

                                                                                                  08563d6c547475d11edae5fd437f76007889275a

                                                                                                  SHA256

                                                                                                  43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                  SHA512

                                                                                                  aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                • \??\pipe\LOCAL\crashpad_3008_ACNFFFCTETVTVBNB

                                                                                                  MD5

                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                  SHA1

                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                  SHA256

                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                  SHA512

                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                • memory/3364-435-0x0000000000920000-0x0000000000CC0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/3364-51-0x0000000000920000-0x0000000000CC0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/3364-88-0x0000000000920000-0x0000000000CC0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/3364-89-0x0000000000920000-0x0000000000CC0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/3532-763-0x0000000003250000-0x0000000003266000-memory.dmp

                                                                                                  Filesize

                                                                                                  88KB

                                                                                                • memory/4072-765-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                • memory/4072-707-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                • memory/6176-479-0x0000000007760000-0x0000000007770000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/6176-544-0x00000000086F0000-0x000000000870E000-memory.dmp

                                                                                                  Filesize

                                                                                                  120KB

                                                                                                • memory/6176-469-0x00000000076A0000-0x0000000007716000-memory.dmp

                                                                                                  Filesize

                                                                                                  472KB

                                                                                                • memory/6176-704-0x0000000074110000-0x00000000748C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/6176-548-0x0000000008BD0000-0x0000000008F24000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.3MB

                                                                                                • memory/6176-470-0x0000000074110000-0x00000000748C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/6176-452-0x00000000008C0000-0x000000000098E000-memory.dmp

                                                                                                  Filesize

                                                                                                  824KB

                                                                                                • memory/6176-606-0x0000000005300000-0x0000000005366000-memory.dmp

                                                                                                  Filesize

                                                                                                  408KB

                                                                                                • memory/6592-1365-0x00000000007E0000-0x000000000081C000-memory.dmp

                                                                                                  Filesize

                                                                                                  240KB

                                                                                                • memory/6592-1364-0x0000000074800000-0x0000000074FB0000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/6592-1369-0x0000000007B00000-0x00000000080A4000-memory.dmp

                                                                                                  Filesize

                                                                                                  5.6MB

                                                                                                • memory/6592-1382-0x00000000075F0000-0x0000000007682000-memory.dmp

                                                                                                  Filesize

                                                                                                  584KB

                                                                                                • memory/6760-1366-0x0000000000A10000-0x0000000000A8C000-memory.dmp

                                                                                                  Filesize

                                                                                                  496KB

                                                                                                • memory/6760-1367-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                • memory/6760-1368-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB