Analysis

  • max time kernel
    81s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 07:47

General

  • Target

    9c7401e5b3991543263c86a1b7e459f3.exe

  • Size

    1.6MB

  • MD5

    9c7401e5b3991543263c86a1b7e459f3

  • SHA1

    6af4c5448ddfc83e711f11c8a0f6634eb351753b

  • SHA256

    c1ffd458cc441fe5d967825862acbc540728517d0f8ec95621bd6edd1a724767

  • SHA512

    08a6897837128c221d00ba4fb301dd8809dca0f9cd0f2c19b2b7874a819cd506be4ab61b44a46c85254496986c43e5d6e41b9b367e2473cc34fa1488c4ae31ff

  • SSDEEP

    24576:YyN9xh58retHiYAJGnlk7VtGwxK5xlIRmEw/DCpNrrsCvaWHzEYJiEjAAK+R:fDxme8JGifGGQEi+pdsIEOT0U

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c7401e5b3991543263c86a1b7e459f3.exe
    "C:\Users\Admin\AppData\Local\Temp\9c7401e5b3991543263c86a1b7e459f3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1708
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1580
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
              6⤵
                PID:400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5308
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
                6⤵
                  PID:5300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
                  6⤵
                    PID:5620
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                    6⤵
                      PID:6412
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
                      6⤵
                        PID:6404
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
                        6⤵
                          PID:7116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
                          6⤵
                            PID:5396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
                            6⤵
                              PID:7028
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
                              6⤵
                                PID:7044
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                                6⤵
                                  PID:6692
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
                                  6⤵
                                    PID:7220
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                                    6⤵
                                      PID:7360
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                      6⤵
                                        PID:7416
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
                                        6⤵
                                          PID:7684
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                                          6⤵
                                            PID:7724
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6680 /prefetch:8
                                            6⤵
                                              PID:7968
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6692 /prefetch:8
                                              6⤵
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:7976
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
                                              6⤵
                                                PID:7820
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
                                                6⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4320
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
                                                6⤵
                                                  PID:6204
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
                                                  6⤵
                                                    PID:7928
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
                                                    6⤵
                                                      PID:6404
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                      6⤵
                                                        PID:7712
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
                                                        6⤵
                                                          PID:3388
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                                                          6⤵
                                                            PID:2672
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 /prefetch:8
                                                            6⤵
                                                              PID:5964
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10483194987540089132,10554088588443718603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
                                                              6⤵
                                                                PID:3680
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                              5⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4892
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                6⤵
                                                                  PID:768
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17501957197614125816,15396369793794156911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                                                                  6⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:6096
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17501957197614125816,15396369793794156911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                                                                  6⤵
                                                                    PID:6088
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                  5⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2076
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                    6⤵
                                                                      PID:4476
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3840461283178531324,11720057410439667258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                      6⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5504
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3840461283178531324,11720057410439667258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                                                      6⤵
                                                                        PID:5412
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                      5⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4120
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                        6⤵
                                                                          PID:3056
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1749661296800310844,12146733603821595187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                                                                          6⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5236
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1749661296800310844,12146733603821595187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
                                                                          6⤵
                                                                            PID:5228
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                          5⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3404
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                            6⤵
                                                                              PID:3028
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6471897427957456657,16545822126877019555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5560
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6471897427957456657,16545822126877019555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                                                                              6⤵
                                                                                PID:5372
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4504
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                                6⤵
                                                                                  PID:4396
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14376606534066842491,2542607086148278209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5632
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14376606534066842491,2542607086148278209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5568
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2584
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x84,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                                    6⤵
                                                                                      PID:2968
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4136166534163683448,5491656852657762455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:6076
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4136166534163683448,5491656852657762455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
                                                                                      6⤵
                                                                                        PID:6068
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5016
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                                        6⤵
                                                                                          PID:2096
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10162731329604637382,11218793941576568929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5660
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10162731329604637382,11218793941576568929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
                                                                                          6⤵
                                                                                            PID:5652
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3652
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9784546f8,0x7ff978454708,0x7ff978454718
                                                                                            6⤵
                                                                                              PID:2988
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9150509092912827976,5575009453932522154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:7108
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9150509092912827976,5575009453932522154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                                                                                              6⤵
                                                                                                PID:7000
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2qc8602.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2qc8602.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:7584
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aJ56bK.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3aJ56bK.exe
                                                                                          3⤵
                                                                                          • Drops startup file
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Accesses Microsoft Outlook profiles
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • outlook_office_path
                                                                                          • outlook_win_path
                                                                                          PID:7564
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:7576
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:6192
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:3196
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:7068
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7564 -s 3032
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:3220
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CC9PD7.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CC9PD7.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:8112
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:6488
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:7120
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7564 -ip 7564
                                                                                              1⤵
                                                                                                PID:8052
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2E4.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\2E4.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:7096
                                                                                              • C:\Users\Admin\AppData\Local\Temp\41E.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\41E.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5140
                                                                                              • C:\Users\Admin\AppData\Local\Temp\A87.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\A87.exe
                                                                                                1⤵
                                                                                                  PID:7384

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                  SHA1

                                                                                                  8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                  SHA256

                                                                                                  d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                  SHA512

                                                                                                  6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  efc9c7501d0a6db520763baad1e05ce8

                                                                                                  SHA1

                                                                                                  60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                  SHA256

                                                                                                  7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                  SHA512

                                                                                                  bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

                                                                                                  Filesize

                                                                                                  201KB

                                                                                                  MD5

                                                                                                  e3038f6bc551682771347013cf7e4e4f

                                                                                                  SHA1

                                                                                                  f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                  SHA256

                                                                                                  6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                  SHA512

                                                                                                  4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                  SHA1

                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                  SHA256

                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                  SHA512

                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  41d5364ca90acb825c774aa7f1f59754

                                                                                                  SHA1

                                                                                                  927dc426dbe52d60ee98922ac807e808f689499d

                                                                                                  SHA256

                                                                                                  d4e9846c0c143ee858a65f302cd7f5f26f955b9d79070cf895b192c51b525f54

                                                                                                  SHA512

                                                                                                  6821383f6b8b7cd6d4b12df9c496e352fe9235080d397b3305c6225476cb62689d4add20ca79b4cfab215ead7151f071f35ff62c522e52ce1312bb7f1a2886ee

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  69b74cfbdaf4ff12028d70ab350dda0f

                                                                                                  SHA1

                                                                                                  8fe9674b38f8a2018ef1285ec0f4721d4d20abf3

                                                                                                  SHA256

                                                                                                  5f32acc4dea31ea8459f2d13f4235fb67fdf2bde429c431aee411335ca6fd3a4

                                                                                                  SHA512

                                                                                                  f53fba7115142fa1eeaa3cdb553ab2de47b5ab739b10ead9cfb235a8f76876eb3b010548df13e8f00a9288671d10fbb62496ce16dd115291bf5211abd8f89cf2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  bfe0a4845a9ff56920146cd3ce106a7e

                                                                                                  SHA1

                                                                                                  3acf31c7d2af2f57a5d168b1b04b371f70371f11

                                                                                                  SHA256

                                                                                                  d6d2b672b1305ca00562e4dbb376804e64d219f355a21828f5e0a6bc6a8175b6

                                                                                                  SHA512

                                                                                                  18d541a4d1a9ee46d79d013dc316d9000fb9a787d0e94ee14cf99cc8832ee7fdc54c6cc2f370d746bfff7290a8a7e4435314fb9b7f5d92632dbf74effb6745f5

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  d0f21ec58b5e3204c86c2bc61f20c97f

                                                                                                  SHA1

                                                                                                  ffca45d273eed2b851e72528038669161557641f

                                                                                                  SHA256

                                                                                                  5a7fee2c10799ce1c340112b263c7e1fcadc78a83d4aa1a2356372033f9480cb

                                                                                                  SHA512

                                                                                                  f18945999b89e98242eab30e4bb38dedba40c9fdeea2a2a0d573b9f38218e851f581502fa506fef1cea5d8883c5d3c744c2ba5fbcbb05a2ab73c3df8bda6cf76

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  07e2fe1966a8b9c4a7d7bae0ba0b67e6

                                                                                                  SHA1

                                                                                                  dd99ee55e72e00dd09baba5525e0ac8f89c54f48

                                                                                                  SHA256

                                                                                                  2d172aa00f218d3d6983cb9157d53225c350b15199f8eb32c0ab730f2222174d

                                                                                                  SHA512

                                                                                                  136aba94d0def819bddb547cdc1c3846600cd80ce81019758b306429e554dd4cf7a7efc5cb368bd92be1d00522a94954ab680af13805f0b8905728be07d09b0a

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  92d498d1673708cd012d9b85f3b73ed7

                                                                                                  SHA1

                                                                                                  d387911b6110cc57383956d306abfdcd8e27bf11

                                                                                                  SHA256

                                                                                                  50400b87fcad5d1dd2dfa46ed433dbbbc630bbb32aea0561c4d05ce26ab952d8

                                                                                                  SHA512

                                                                                                  99682b3c2b0b9c07cfe6ce3150f3f2194051819d5bb30474da4be774a169ba8f4b6a07ff83812eb1a544cb19b7ed59081bd2f1d0bc55dde229f30f40c599c824

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  d869cb44c8ff47230b652149d59a988d

                                                                                                  SHA1

                                                                                                  ee4dc7032474b6af5dd1caab8abbf1fdadab29ac

                                                                                                  SHA256

                                                                                                  5564f7e2ef730bbb325d814ad74b9b9d77f9fdf91f05cb45d5a00e4bb72b2891

                                                                                                  SHA512

                                                                                                  6db59ec622b76ac4b467afb066afe097e22e7c62a5a50fb6360543337e500e669178b1163d2691c4c58969547621916cf77ab4eb5c26889094148f4d598b5e73

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  1049fd226e7026044f607ca4ab038e9f

                                                                                                  SHA1

                                                                                                  d07f775c4562cb25f19999f206f907a6e6559e09

                                                                                                  SHA256

                                                                                                  e748d153733b177c5aa431f796a82fad384c1630205a8d20c587b67f77f4d988

                                                                                                  SHA512

                                                                                                  c68a046b6d232522aeb7eff0c1a442fb2f8d4ae66448a31495fc37bc89afb3c66f4ab9b24993a4638726ecccddfb29770d3c891958a872df97646a66c28efdc2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  396B

                                                                                                  MD5

                                                                                                  273a659d01e870e7ac8a2f7888a607b8

                                                                                                  SHA1

                                                                                                  e50b6240dffdad6165f26d659708eff6bd3b2c68

                                                                                                  SHA256

                                                                                                  6a1dba92a81c57e282edce4890a7d67d496d06fe9484ae41cb3f4c6b6e636f5d

                                                                                                  SHA512

                                                                                                  ba52ea46060f54af73dd1d452d24ea9fca56f9ff452491643da6690291e246d2425e11adf0f10daec05b7193eeea273dfccdbb94854d9f4a6552c9ad4fd53557

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  b00112add1bcaa2af55a25b08ee7246d

                                                                                                  SHA1

                                                                                                  4589c9bef5e1ae2fd6e80c6b4b60821e08920b43

                                                                                                  SHA256

                                                                                                  c482fb8d987c52b2363d70c398797097e9483f73be1507f2e62a95d11c725bcf

                                                                                                  SHA512

                                                                                                  cc0f965505b7492bef7aff9f6e75ea9be28dc558b1d8a343d42cf82fb9de1f4ded6073c39e78e569a607641af1e376222c1b4fa1db4d8071c70f103d3d3b7f07

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                  Filesize

                                                                                                  393B

                                                                                                  MD5

                                                                                                  30da81c1a0a949948c812edb45e34c95

                                                                                                  SHA1

                                                                                                  23de611960ad904caa33027b6d60f2c3429c31b0

                                                                                                  SHA256

                                                                                                  077ff4e733527824dd1d937c5904856ff565d77dafd591bdddcf56f71ade021f

                                                                                                  SHA512

                                                                                                  0d8938f473e917be1a29300f1db10a9659ece106abd6e603cd91290eab3372b68ca5ecd803939c3ed5234f4812a6bae0c3f7b3e718271369fd56ec98aa11c820

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe5846d8.TMP

                                                                                                  Filesize

                                                                                                  353B

                                                                                                  MD5

                                                                                                  03415277cc9abee0ae316077b06ebf6a

                                                                                                  SHA1

                                                                                                  2c33feeb5c3d2e4c5a9711c2eb6a3dd77ba54200

                                                                                                  SHA256

                                                                                                  18ffd259958170a0336772403a5bfc74e46eba55bfe9c8f4174e3a061ff33f35

                                                                                                  SHA512

                                                                                                  1239a00250068525b0f930ad7e2d4980edbecdaba6f0c013eb32406f8b2a4badba439e550774471bf7bd6ae41ec0ab3bb43a70751932b5b92c4aa5bf16faa4bd

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                  Filesize

                                                                                                  23B

                                                                                                  MD5

                                                                                                  3fd11ff447c1ee23538dc4d9724427a3

                                                                                                  SHA1

                                                                                                  1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                  SHA256

                                                                                                  720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                  SHA512

                                                                                                  10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                  Filesize

                                                                                                  111B

                                                                                                  MD5

                                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                                  SHA1

                                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                  SHA256

                                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                  SHA512

                                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  5KB

                                                                                                  MD5

                                                                                                  e78b3fa48ff8733c81108ff59ad08d43

                                                                                                  SHA1

                                                                                                  9c3e53b7e43fe191f978deebdf55a2e8d3af77ac

                                                                                                  SHA256

                                                                                                  61fb261b6e458bd020c6926044bb0543dcd52aae2de1fcd3e3d617711d49af84

                                                                                                  SHA512

                                                                                                  7233eaaf415cce736771af298a59716722c3d4d50f2d84e9a0fb4c63aa0c48982620f8c82bfc2c3f807cf7f6e1ce2d3a5d6090f15366688d7aa60c6aaee2e159

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  b6d13bdb21b6e3d882169120335751c0

                                                                                                  SHA1

                                                                                                  76984b0737950990fbb12986389b027dc11dde80

                                                                                                  SHA256

                                                                                                  cfeab81af3431f737d5abff27e69debb5f6e9bd358250418f6cf6b53561d060d

                                                                                                  SHA512

                                                                                                  1d7d95956268ae57a9907fb9c39a45d62144476156c85815324975d2ea51883ddad3f05eeec35fd98b285b053553cfe73cdb8cc1475b592abdd0b4df724df9f4

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  62ff6c19ed5742a42898d2454c7e4473

                                                                                                  SHA1

                                                                                                  a8a8c9f57265b22d4100515a9ea519b8bae71681

                                                                                                  SHA256

                                                                                                  f47bee3a2133401b68311b8dd92f02de293a1f73b1bfdcb8b4b4f1a0f079f074

                                                                                                  SHA512

                                                                                                  9888bcb218a31f3659dbe9aa90f32f96eef0568d1bd06f37af40cbe587d91a73c43988aaee2f9ca7dd2f7615767b90e59af8e116a422daade3af8c23e30c6e3e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  7b9f8db3389344db1d9d706f348710bc

                                                                                                  SHA1

                                                                                                  7d7c30d700d79a448a3dee1a77da55a3e0cf94a5

                                                                                                  SHA256

                                                                                                  ea1635cf7cca1b7824160a01ecc03faff1ff9ad38c36423afecfef4bc519df0c

                                                                                                  SHA512

                                                                                                  0742b0cb605c5160cca6223960a88e6348cfa64f4ee02cf4ef451316db1014de3b6ff17e024a847c5bbfbcc6fe9bd4c0975899a9e414d0a3fade01abdda8707e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  d87cf83a80422d81fa35c39942d28acb

                                                                                                  SHA1

                                                                                                  aab4f6377507e19a06130c7ac2c84db4a48c1a29

                                                                                                  SHA256

                                                                                                  e08edddccc86005c0ad33e0379c6f42c1fe32bd738771afe418766e910b76c64

                                                                                                  SHA512

                                                                                                  872c8487ef274bd402417a98a6167dba0b86b88220ac57206e6ea6d956c1270a465793dd245a803393f58037a3d671aaf86d87fb04311f69df95ba72af97e17c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  MD5

                                                                                                  121510c1483c9de9fdb590c20526ec0a

                                                                                                  SHA1

                                                                                                  96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                  SHA256

                                                                                                  cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                  SHA512

                                                                                                  b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  89B

                                                                                                  MD5

                                                                                                  15f5bce3bbf528c218b6bb700c2f5531

                                                                                                  SHA1

                                                                                                  6a68dc1cc9f593ca85e5716e1ecefb60c5afae70

                                                                                                  SHA256

                                                                                                  574374b394d00079930c79e5baf9628ffde007c0f34cbecc1f7263af9c54fbad

                                                                                                  SHA512

                                                                                                  ed2c260a30d78369a44d5066fdc12b13b9b2354fd43e8f04bf1e19947605ed8a407351b679dea9b1bbbc3437a42acdd8491c22df774d57d0522267a609ccfc54

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  146B

                                                                                                  MD5

                                                                                                  ca6a3fa9d3e1ea3d4cedd990ff15c974

                                                                                                  SHA1

                                                                                                  3b58c68be9559d7e40f3165d02b615d30b8771bb

                                                                                                  SHA256

                                                                                                  c182e22d7a0dc3637d6ead636b11e647d7e9d4201481db15d6ab1a0089d8eff6

                                                                                                  SHA512

                                                                                                  7909630b31b9c419fbcbee234be2c4dd9474911d40c545c79c3951054532264ef7eea770bb0a7d486b08c8e105593e8064d2386e7af8cbcad5a9d576be886cdb

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                  Filesize

                                                                                                  82B

                                                                                                  MD5

                                                                                                  2e26c9c40f0186db2094229b92f3513f

                                                                                                  SHA1

                                                                                                  d55e0cdd8e404a6b03acdedac5b9e8beac8c7eed

                                                                                                  SHA256

                                                                                                  0134f1070bdfb6026965df3b9b669280c1d571a7fc78c5ed5bfe38f1fd2fa23a

                                                                                                  SHA512

                                                                                                  d18723b56f95307c342480f47c4849d32838799f1cee6463f7cdc5d7589145fbc6bb6d651ce11a78bb13d1640b9fe4abe7cef3ffa26bf835279e9005d621d394

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                  Filesize

                                                                                                  83B

                                                                                                  MD5

                                                                                                  aa3854747510e2bbc00c7bda478b948e

                                                                                                  SHA1

                                                                                                  06da28e76d57c7f0d49607ec8a525241f3cfe1fa

                                                                                                  SHA256

                                                                                                  d9214b5c58346265b7e70d16459acb131c6d024b43e8d939cea5214e754c7635

                                                                                                  SHA512

                                                                                                  e8341eeb7afbdcb4b9d8aea9521c4024c8361534769fc40ee5158ec9659a5c1cb9f8c575762220acf5f7271139ba20781c4bedc2a60a41279f58b6dd865ea357

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  fd7ec6eaac22a87b4b247913c5d65e5d

                                                                                                  SHA1

                                                                                                  7cc998509c92969fd561a022c29a7abd81e212f8

                                                                                                  SHA256

                                                                                                  a2b6420d74b313604d5b81a6e4ac87f14b9aaf747546e07990614d7ec0c2ab6c

                                                                                                  SHA512

                                                                                                  cfb08722b90c60793d788a3ac6453f12ac922173596ff9c502a7555aa2d45ade83d013a964d0b9e3543d24458c931b959471cc5d1e041f2aa803302c1a147931

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  833e8e58b596164c2ed89d207c8e0ec4

                                                                                                  SHA1

                                                                                                  0a4bf2705ddb44b46f6330830d69908bcbfdb6a9

                                                                                                  SHA256

                                                                                                  92f5cc89728e5e6d16d87f3a4d6e0c1c3c6b97accf80872d744f6d9ce1f0e008

                                                                                                  SHA512

                                                                                                  f68aeaa40b604e50f931fe1f3c3eee90f8789161b28056d9b66bcd4ad88e2a250540e3c5a635bc0b7494571519bf71b9cf1b4b8518df48dba6b653f72f1e4bef

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  8ca3418a4eb68c75f8f71d8aa3a3d25c

                                                                                                  SHA1

                                                                                                  8a1fefae512f60bc5f85e3128e5830d2ff63f984

                                                                                                  SHA256

                                                                                                  adf618b2edd4a082cfade4aade366d72678866beafc6d94240283892376985e3

                                                                                                  SHA512

                                                                                                  411dcece14f67c662714ddfa0971face05b2571c63903080f12423b9b9b114345a38ae7ae482fce5b2b4b7406b3717c1afd8537879a16f6e82cf2b2bee527b17

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  80198303542f30818278ba9ce851e108

                                                                                                  SHA1

                                                                                                  df4cd11fb2e23bdf0ad5d9e6b8ccf63fb2af9f4b

                                                                                                  SHA256

                                                                                                  eb99f2e43abb7784a9fbbe9cf32bad1988cd0e2a83bdb581d180dbe02a88008f

                                                                                                  SHA512

                                                                                                  e300878a02517720ac613843edc90f17e4ced963e2021fdcc906f1043553b2f6c11964e0e2c94936e1595ff44baedd906375b5baa465dc00af5c091d12f6064e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  c7d71b7cd016cd43cac4d6ea9b113c21

                                                                                                  SHA1

                                                                                                  73d80a85ef650e3891101291a9e4b19acd8b3df2

                                                                                                  SHA256

                                                                                                  9aee98cfa18c43af11d6a2d5897c4dd157be8b6443566c9a3d5131d17744fb60

                                                                                                  SHA512

                                                                                                  1851823749702d9aa87dc1585df840dddc41a75ce7644d946182e4147016f2a54e20bf8b2264872e3fe99b0e52c44326958073302dbfc126bdc5469ac9fb57ec

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f90.TMP

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  1c83e95052a57176c02aa205b06a3d48

                                                                                                  SHA1

                                                                                                  b3dce1025f83abcd24221152c7ee58c8a0cab2a0

                                                                                                  SHA256

                                                                                                  5b225b88c52f5d6425ee838a56cf45f97c14ac36dce87c7700aaf76d44caa6ba

                                                                                                  SHA512

                                                                                                  553676ae00770033930f30883b173cbacca383bc6ffc7d82dc0dc28abc86b61d07379df4d351a1d72a5faabad025068598843dffcebf06c7a114b0bd5cb3b82e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                  SHA1

                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                  SHA256

                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                  SHA512

                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  7079ad80584907b52d0b82f19448a8f1

                                                                                                  SHA1

                                                                                                  0d1d535eb7e2ad32c98ac4e15ebc31f32d72dae8

                                                                                                  SHA256

                                                                                                  1f2e57369ecf1f70a9879ae20ee1cd86c2ac85eebcbc17c1ff372fa21c04b429

                                                                                                  SHA512

                                                                                                  6e1a9e5b69af022eaaeba6d3982caa7f831480b2021bb7e46d8cb37ac9496027f2d3335719fabf65d2eb3e234275e67375b159b9f9d7f6a83524b16ca7f33eb7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  65352c4453f251d137a2b16b1ad9ebb0

                                                                                                  SHA1

                                                                                                  57ae6137fc1fd7ce186d81f6c6d0a1b98753eec1

                                                                                                  SHA256

                                                                                                  4dad1654c6e3caa63389a0206ef95090f1f44ce33662b84d0205960a798e0eb3

                                                                                                  SHA512

                                                                                                  ca32cf431b8fc23d7ce66ea6686bd766280fad1f5d872bc562889a4536be7ec516224395cc291ba5cd0691058059ea79a878b245ac0de51d6cf8def9cbe36462

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  ed89b2b158e3fa6882c3233e6391bb04

                                                                                                  SHA1

                                                                                                  972264318810c208ba559740b0c439c20abf67e0

                                                                                                  SHA256

                                                                                                  338dd408700552434674cc715fd3c8bf0be212f784d4fb0da4cd379f9b19e198

                                                                                                  SHA512

                                                                                                  40f5cd6a69827b2e3561c7c2ed6ad71fa4700ebe4157b5d3d6fddb17429f4a6d9df2bdd422a879629393f2e68388dc32ab5972c6498bbc547a14b9d8056c3928

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  e89ca3fde40a12590db3bef6a032f313

                                                                                                  SHA1

                                                                                                  b20906911d25434867475f708a539f1e21f8da16

                                                                                                  SHA256

                                                                                                  d991f39622da5232409bb5d0a42f631f0cfa834aa2a28cf0593955a35c64c3d8

                                                                                                  SHA512

                                                                                                  a4c909e9513e646e706682932521c87fecd526b32287459f6927919ed856b2af78374242815dca6260bd203b3c89f75abc6328233c8c2d4ac509d61a3768f18e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  56b54b39a3820e3ecb4cb6c1f1d675fe

                                                                                                  SHA1

                                                                                                  0b22c90c8563619dcdcb5b9d26ff68c81aa934a4

                                                                                                  SHA256

                                                                                                  5c8e34c7ff584fa20f001ef982e51a2b005eeabe9dba306405638f445df450c8

                                                                                                  SHA512

                                                                                                  a5a32b58cfdc7d58809f207c853e3f30fe94cddd96227666d690e413bf76fb7a3f1bb26e24989cd228e29988a39f5011731cb22f48fc1848fe5220b30ff5e3b2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  04f80e0af3476dbe2fc8ff7a00d25288

                                                                                                  SHA1

                                                                                                  a2e3c995c8cdf984a2e6ecf5811b00648ac985ef

                                                                                                  SHA256

                                                                                                  df0a1810ea6ce52d4c594e3c3abe3f13f872f4c2515a2f16493f2e9a359474d6

                                                                                                  SHA512

                                                                                                  90b53a904a7ed12d05572b5fe025c09d627659b4382227ac500258e270266ff5eab3d529f2b25f6bd4c546ea3dc0914095be6527c6249973196596e5aad04074

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  b8d6b0ff647b296c5387a97780188e45

                                                                                                  SHA1

                                                                                                  9c49835a8b49e36fb326a6a0e267a37dacecd811

                                                                                                  SHA256

                                                                                                  f5f4b27e62729c4c91bd6078d46c0074a355309376586fabf9964e5ed587fef7

                                                                                                  SHA512

                                                                                                  18ed2065d086448b3ec5183ef9f2219173e0b08bd651ae77cc92e907c7ca9c6b4c11dfa704f0139a7924961bfb655dd9f89fe816c127f1806d0cc5d97056f910

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  8df32ca21c6c9f80267f506e19f038f2

                                                                                                  SHA1

                                                                                                  a80e5e7cfe2747f1c9a9f603e7b3262048f72884

                                                                                                  SHA256

                                                                                                  fb991a67be70689e03248d8757c30f6ef586ec911cae873a55c9b866a3b08e03

                                                                                                  SHA512

                                                                                                  5e8d157b71fe65639201057e0c9e321c6e3183bc3dbb87aa005cdfb2b2b1f4d30c733174d7e2088335b1ab1e0dc77f3b0b236e8072608e9ab2f0026f5e6289e6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  fc1cd4168e3aa6deca1ace825c168c30

                                                                                                  SHA1

                                                                                                  82e3917fe64f75831d9de78679e4224941a49a04

                                                                                                  SHA256

                                                                                                  06a7ec27419e9a155f9a4947ff3f21db6a3dbb42103fa99c765fd8be2708d269

                                                                                                  SHA512

                                                                                                  57bcfe447725c7a4457245a847f9283f084e7ce88320f7f58faa5165e098f14d54f738577fb5e1b718062e97039c163ee0509bfa1bc04d9d205f5d03e72b1634

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db14e23c-eee8-458a-b05e-255e07e10b42.tmp

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  4ac8cb41cfe70504154dd4c00b2751de

                                                                                                  SHA1

                                                                                                  8882d6b0766465a388dae4e2a07966d1a3984268

                                                                                                  SHA256

                                                                                                  5d1dd98ec391296ee8ec8c1712e1f612f17c3d7c673e0a69180c6bd6bf1cad14

                                                                                                  SHA512

                                                                                                  f89dac5df0dcf1cefc29100c655d7e4fca8c6385b833e6b5799dd6d7bba58e046181d6fac9c6e6716d72ad76d6619afbe79a4fa2e71c72ae4ccad1e920b722c7

                                                                                                • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                  Filesize

                                                                                                  576KB

                                                                                                  MD5

                                                                                                  aa88c46489d7546cbcd824cd2db491a6

                                                                                                  SHA1

                                                                                                  8720462a4aaf5cd0bba1e70aebe4bad3f9a3d332

                                                                                                  SHA256

                                                                                                  5be10f76fb36f0e1ea0d95008d66a554c6243efe86909fca0a0680977cbc7b13

                                                                                                  SHA512

                                                                                                  1ed6e1a12376675ac044ad84344b356c5057ceca457aff906ea40692a14a3057229ff06babea6e2470c439ad15446649974419fa5a8e33986e91932d0ad30253

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TR5IC49.exe

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  MD5

                                                                                                  fd995fd4c77510bdc96abed2328da9a0

                                                                                                  SHA1

                                                                                                  e582c2c6b53ce25951678ab3ebe7b3f2e0defaa9

                                                                                                  SHA256

                                                                                                  df8c8a5bcc42f55b2a53c893302ceba939bdeb7e171145de9076512600be4eae

                                                                                                  SHA512

                                                                                                  338e258c79905f17916183bbc639eaa00ad096e222187f29f128d17eca60a3c354c1c2ad271e9dddf6017c2ee291cee6681d6a64dc9829fcfd8a9f65fb173f38

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Uu0lD21.exe

                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  63ea06d9a0f6e1986edddec56d1ed96c

                                                                                                  SHA1

                                                                                                  698bcab0f605e7f0406056005f177e7ef75800fd

                                                                                                  SHA256

                                                                                                  71c0e948518a8f2729d1f495815c7bd7a09bef19b4f4c9375a80cb22345d7c36

                                                                                                  SHA512

                                                                                                  434d3afb667c5f1f2a2777df0820d8f84abd8460239010ac8a64af7f47b248a9ae561fded5e8e1ef2d4ed77d4b7cb2538a7e051640689b6e16ebb93dc9788897

                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Jr91Gt4.exe

                                                                                                  Filesize

                                                                                                  895KB

                                                                                                  MD5

                                                                                                  9411aa64fdc6b8e8558b9fe8bda63795

                                                                                                  SHA1

                                                                                                  99800ce89efd412df440afd2342cdd240882f25e

                                                                                                  SHA256

                                                                                                  078da73239ce54f75b116fa2a6b1623ca10adf18f8c500625236e147456df588

                                                                                                  SHA512

                                                                                                  c3737f489d09e114af4a20dfcd523e3ed71d460f056dc06289a96da5a8d067dc17ff527828d346aa3e05741215c6a5a407bb05f69cdd620ba46835983fe04927

                                                                                                • C:\Users\Admin\AppData\Local\Temp\tempAVSMA76s2uhwEcY\0OQYbkGnl7XwWeb Data

                                                                                                  Filesize

                                                                                                  116KB

                                                                                                  MD5

                                                                                                  f70aa3fa04f0536280f872ad17973c3d

                                                                                                  SHA1

                                                                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                  SHA256

                                                                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                  SHA512

                                                                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                • C:\Users\Admin\AppData\Local\Temp\tempAVSMA76s2uhwEcY\ByMejWyvfmCxWeb Data

                                                                                                  Filesize

                                                                                                  92KB

                                                                                                  MD5

                                                                                                  ec564f686dd52169ab5b8535e03bb579

                                                                                                  SHA1

                                                                                                  08563d6c547475d11edae5fd437f76007889275a

                                                                                                  SHA256

                                                                                                  43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                  SHA512

                                                                                                  aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                • \??\pipe\LOCAL\crashpad_4120_VVOALLXNXWCNZCWV

                                                                                                  MD5

                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                  SHA1

                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                  SHA256

                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                  SHA512

                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                • memory/3496-988-0x0000000002E00000-0x0000000002E16000-memory.dmp

                                                                                                  Filesize

                                                                                                  88KB

                                                                                                • memory/5140-1541-0x0000000007010000-0x00000000070A2000-memory.dmp

                                                                                                  Filesize

                                                                                                  584KB

                                                                                                • memory/5140-1540-0x00000000074D0000-0x0000000007A74000-memory.dmp

                                                                                                  Filesize

                                                                                                  5.6MB

                                                                                                • memory/5140-1536-0x0000000000260000-0x000000000029C000-memory.dmp

                                                                                                  Filesize

                                                                                                  240KB

                                                                                                • memory/5140-1535-0x00000000749A0000-0x0000000075150000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/7096-1537-0x0000000000930000-0x0000000000A30000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                • memory/7096-1538-0x00000000024A0000-0x000000000251C000-memory.dmp

                                                                                                  Filesize

                                                                                                  496KB

                                                                                                • memory/7096-1539-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                  Filesize

                                                                                                  4.6MB

                                                                                                • memory/7564-768-0x0000000004DB0000-0x0000000004E16000-memory.dmp

                                                                                                  Filesize

                                                                                                  408KB

                                                                                                • memory/7564-530-0x0000000007150000-0x00000000071C6000-memory.dmp

                                                                                                  Filesize

                                                                                                  472KB

                                                                                                • memory/7564-575-0x00000000071E0000-0x00000000071F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/7564-913-0x00000000742B0000-0x0000000074A60000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/7564-705-0x00000000082E0000-0x00000000082FE000-memory.dmp

                                                                                                  Filesize

                                                                                                  120KB

                                                                                                • memory/7564-708-0x0000000008810000-0x0000000008B64000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.3MB

                                                                                                • memory/7564-522-0x00000000742B0000-0x0000000074A60000-memory.dmp

                                                                                                  Filesize

                                                                                                  7.7MB

                                                                                                • memory/7564-520-0x00000000003B0000-0x000000000047E000-memory.dmp

                                                                                                  Filesize

                                                                                                  824KB

                                                                                                • memory/7584-515-0x0000000000220000-0x00000000005C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/7584-300-0x0000000000220000-0x00000000005C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/7584-331-0x0000000000220000-0x00000000005C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/7584-332-0x0000000000220000-0x00000000005C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  3.6MB

                                                                                                • memory/8112-989-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                • memory/8112-929-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                  Filesize

                                                                                                  40KB