Analysis

  • max time kernel
    74s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2023 00:17

General

  • Target

    6c36f21de5c193646f3a63a8f44eff6c.exe

  • Size

    3.6MB

  • MD5

    6c36f21de5c193646f3a63a8f44eff6c

  • SHA1

    269e45e860ed40e7fcb1de9f7a0118493de77b4e

  • SHA256

    01497dea122f92d36b4e0ae4eade31511b2db302e6f7f87a695e817065834281

  • SHA512

    60afcbf8c82b455f85063d28857e39640437c221dd1af2baccd22ed554baa5b5f1beb593a595cbd572e1fb6f477320eeb244ded4c587f11231502470c17d5c99

  • SSDEEP

    98304:LBq9McpKSkVkUluJE1va2P1SUHCeNyem8TbPMQEqExd0:2Mcppa++a2PF5yem+bPk

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 4 IoCs
  • Detect ZGRat V1 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c36f21de5c193646f3a63a8f44eff6c.exe
    "C:\Users\Admin\AppData\Local\Temp\6c36f21de5c193646f3a63a8f44eff6c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EO6sz80.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EO6sz80.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QB0Jd67.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QB0Jd67.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1qG14AF4.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1qG14AF4.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4368
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4868
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x80,0x174,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
              6⤵
                PID:1956
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                6⤵
                  PID:5508
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
                  6⤵
                    PID:5684
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5624
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                    6⤵
                      PID:4656
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                      6⤵
                        PID:6052
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
                        6⤵
                          PID:7048
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
                          6⤵
                            PID:6308
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
                            6⤵
                              PID:7264
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                              6⤵
                                PID:7384
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
                                6⤵
                                  PID:7564
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                  6⤵
                                    PID:7652
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                                    6⤵
                                      PID:7732
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                                      6⤵
                                        PID:7904
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                                        6⤵
                                          PID:8112
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
                                          6⤵
                                            PID:8168
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4076 /prefetch:8
                                            6⤵
                                              PID:5984
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4196 /prefetch:8
                                              6⤵
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5820
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
                                              6⤵
                                                PID:7396
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
                                                6⤵
                                                  PID:6092
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
                                                  6⤵
                                                    PID:7404
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1
                                                    6⤵
                                                      PID:7408
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8096 /prefetch:8
                                                      6⤵
                                                        PID:7748
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8096 /prefetch:8
                                                        6⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:7380
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                        6⤵
                                                          PID:6076
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
                                                          6⤵
                                                            PID:5492
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6556 /prefetch:8
                                                            6⤵
                                                              PID:5380
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1277445134148934280,10832013754225786788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
                                                              6⤵
                                                                PID:6824
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                              5⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1768
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                6⤵
                                                                  PID:3096
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4061524278557759125,9915613606385988852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                                                                  6⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5700
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4061524278557759125,9915613606385988852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                                  6⤵
                                                                    PID:5692
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                  5⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1308
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                    6⤵
                                                                      PID:440
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,178817264774376521,14398001363455036918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                                                      6⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5548
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,178817264774376521,14398001363455036918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                                                      6⤵
                                                                        PID:5532
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                      5⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3160
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                        6⤵
                                                                          PID:4416
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,795679817655022776,18222713176231815644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                                                                          6⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5612
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,795679817655022776,18222713176231815644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                                                          6⤵
                                                                            PID:5600
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                          5⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:696
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                            6⤵
                                                                              PID:2028
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7866659761436842865,15651557364683219958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5640
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7866659761436842865,15651557364683219958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
                                                                              6⤵
                                                                                PID:5632
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3320
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                                6⤵
                                                                                  PID:2204
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13061639327641011570,9975222092776978298,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5304
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13061639327641011570,9975222092776978298,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5296
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3708
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                                    6⤵
                                                                                      PID:1600
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,17031742562138617705,12480322098811494718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5668
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,17031742562138617705,12480322098811494718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5660
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2608
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                                        6⤵
                                                                                          PID:2348
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,12837323761685794631,13675827830663756064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6728
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,12837323761685794631,13675827830663756064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
                                                                                          6⤵
                                                                                            PID:6716
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4148
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x124,0x16c,0x7ffc39d546f8,0x7ffc39d54708,0x7ffc39d54718
                                                                                            6⤵
                                                                                              PID:1236
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,16451209018895079925,2573877564709109579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6876
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lA5073.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lA5073.exe
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2768
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 608
                                                                                            5⤵
                                                                                            • Program crash
                                                                                            PID:7396
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gX182ds.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gX182ds.exe
                                                                                        3⤵
                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                        • Checks BIOS information in registry
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Adds Run key to start application
                                                                                        • Checks whether UAC is enabled
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • outlook_office_path
                                                                                        • outlook_win_path
                                                                                        PID:6820
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                          4⤵
                                                                                            PID:5448
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                              5⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:6096
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                            4⤵
                                                                                              PID:2212
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:2384
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6820 -s 3052
                                                                                              4⤵
                                                                                              • Program crash
                                                                                              PID:5332
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Uv8Uf1.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Uv8Uf1.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Checks SCSI registry key(s)
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          PID:1440
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:6612
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:4840
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2768 -ip 2768
                                                                                            1⤵
                                                                                              PID:7460
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6820 -ip 6820
                                                                                              1⤵
                                                                                                PID:3156
                                                                                              • C:\Users\Admin\AppData\Local\Temp\AEE8.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\AEE8.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:7336
                                                                                              • C:\Users\Admin\AppData\Local\Temp\B0BE.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\B0BE.exe
                                                                                                1⤵
                                                                                                  PID:4356
                                                                                                • C:\Users\Admin\AppData\Local\Temp\B8AE.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\B8AE.exe
                                                                                                  1⤵
                                                                                                    PID:7652

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10094c23-2215-4f5b-84e8-6a5b4b121e21.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    009a81f61e1908f98c83d8f0073fb122

                                                                                                    SHA1

                                                                                                    9b4ae8217fe9880221244a9b4385054a86131d7e

                                                                                                    SHA256

                                                                                                    9baf4e2b55f866ed1e4960d17e6316d17f7001ca66bcc127127f3a0a744a4878

                                                                                                    SHA512

                                                                                                    925efc6acde52ffeaec42d9ed36498f12ee2258bc6e9037e64ac185f99ec7bf58041af5dbc0806601e0c2e3b59a12d17dc038de883bd5524f5fc3655c91f9c76

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12a75f5b-f7da-4652-b757-de0dc8a74d6b.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    e951ca72f9d917c5b9f6f40558855b9b

                                                                                                    SHA1

                                                                                                    0334879b7a14a3a35e0031d8b863ec0ae85cd366

                                                                                                    SHA256

                                                                                                    2e9cf12409422e9d26c934af1e04efe17c6298285ad689e03d66d365d79030c7

                                                                                                    SHA512

                                                                                                    5f73e9c0a6f04479b6ce5edd33ff3c2ca0bc83caf84a6efee08a106f91ab2e0c5ae9bfd05fbfeab5d32a631902d73afd131f5c36b7c1e72bf3a620b59428fd37

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                    SHA1

                                                                                                    8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                    SHA256

                                                                                                    d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                    SHA512

                                                                                                    6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    efc9c7501d0a6db520763baad1e05ce8

                                                                                                    SHA1

                                                                                                    60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                    SHA256

                                                                                                    7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                    SHA512

                                                                                                    bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

                                                                                                    Filesize

                                                                                                    201KB

                                                                                                    MD5

                                                                                                    e3038f6bc551682771347013cf7e4e4f

                                                                                                    SHA1

                                                                                                    f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                    SHA256

                                                                                                    6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                    SHA512

                                                                                                    4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                    SHA1

                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                    SHA256

                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                    SHA512

                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    6061586fc79d6065b21032837d37c0fd

                                                                                                    SHA1

                                                                                                    ac5558edb7f44480b83b3983c002ab7e2a350486

                                                                                                    SHA256

                                                                                                    fa53718ea93677b97b3900ff92fa9f2ad4ec9697be7dc0098dadc9df516c9e18

                                                                                                    SHA512

                                                                                                    1a6d26f8b484e6341ca1da5dc59b6fc7d5f8bf251122e6c24f055ce63150976d814666021e626001d7095f30e5b4ec9a22be2e408b580e303a96d86822aec2a9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    419d5223898aefd8f611f0d5342dfb7d

                                                                                                    SHA1

                                                                                                    f91cd190286771b14d19cc1347d8c33e08e5b932

                                                                                                    SHA256

                                                                                                    f9466dfaf233a1ba5b5435cc1b0db2752c885e6735c1ec0a2c6ed35399178d76

                                                                                                    SHA512

                                                                                                    99f439547e7e2e6cfbbc446817933b6076d8f53e4cdb8df8cf5031d5c56a4e38be13c86fbf589e4da35d37519d066713776180a145b4f1af14c7ba08dad92435

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    41da98b67978077db33c3cee9b6c89f8

                                                                                                    SHA1

                                                                                                    88da954a5ca331856a1787b7c765b2763e88ddbc

                                                                                                    SHA256

                                                                                                    8b9a3be62aeb34ff1ef882145acbfc90bc645ee0b62fe1cff3f8570b96badc4c

                                                                                                    SHA512

                                                                                                    a6342733fa4519747e0897e49c411d2672810f093802bbcb2a87650c2a2bc1ce6bcd3555aab8a25f37d0c5d87f71d33221a8aa63513a07116845be83599ee461

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    625982da96ae0e20f550e01410233164

                                                                                                    SHA1

                                                                                                    689e5549207fd868ede9f3c55da8828786ec64b6

                                                                                                    SHA256

                                                                                                    a2ac90822c054222c3f5ecd6366eaee075d368cd2b21de782192ebea9a710834

                                                                                                    SHA512

                                                                                                    be9a67fcabb11734f846cee60df5960c1857168a7045499ff5eec7011020890753c17755fc727e5275eb9baa363886571c07e1966769707870f32359a11b5c48

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    250d3f3770193e9cb3d9edcb9909a862

                                                                                                    SHA1

                                                                                                    2bb688880c35694cfb3f78435d07208574fd792a

                                                                                                    SHA256

                                                                                                    e36cce423fe9ac416e8d7c155200f49e24a48239503e49970fb77ae1d506dc5b

                                                                                                    SHA512

                                                                                                    e69f28f22567c759240c51e073fb0fe941c1d6c85272bd6fb604f1b560b01f747324bcd73fac051008d886806b93920754971c13ef94b3e44dae6a3595f7bcc1

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    e0dc3ab9843d8ce3f68926b395681719

                                                                                                    SHA1

                                                                                                    38b1519e7e4b8b4ff02551840fdbc579e69b09e3

                                                                                                    SHA256

                                                                                                    128159a51df48767f439d0457341c1321633cf9903bfc6538f6689b038c5909f

                                                                                                    SHA512

                                                                                                    96915e00c16a7b67f03d77b91faeabfd9f6b3bae610c9d1fe08f58458b8021bc77583f4783ca8f221100da3cdb23c2b6549be520c526612edc266f7bba75b79f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    ffd5e45e550fc6ea2a5b2bdb622b639d

                                                                                                    SHA1

                                                                                                    74ffd16136708cb9bee4db88c2cd1a181c6c3441

                                                                                                    SHA256

                                                                                                    26a280b2c9221bfdeb3616abda2fcf545550478710c7b9c827fe15240b88670a

                                                                                                    SHA512

                                                                                                    ee3691e4ce5faaa3c81999efa11cbdc708cbad68ad56b528be7e90a4ef6a889c55e9d9be5e03b328c35deb098b57b5645d610c66df4616ef602a0995df0883fa

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    9197eda0a16d953cbcb6051265f0601b

                                                                                                    SHA1

                                                                                                    1a7f4c86f9b3240ed26cdee418721df5d3fd32db

                                                                                                    SHA256

                                                                                                    9789a061cb0d7cd99c8dec7dd92594f0ffd4d17e273b968ec2a9aa502d9ce4dc

                                                                                                    SHA512

                                                                                                    1eb8ff5f7c18e9b034fb10c8018f69b5a712629813f0bce6202ccb2fa676a660a6b1c69c3895a6c090c0399f7e7252074fb1b1a90ff1589b0e23143ffa7b4c0c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    c19ce691bae6029f79921fc69c735187

                                                                                                    SHA1

                                                                                                    e7ead37a239ee0fd193809fd134a6b8f3d900191

                                                                                                    SHA256

                                                                                                    7da94bfa027ae05b202dfd4c7ab5b8cbcc4ee24c67b922f0263c5b701a03390c

                                                                                                    SHA512

                                                                                                    7062de9e2b9626c1b6cc9afffc7d4fc8282dbb840be56d924b1d0acbfab526576486b86a71cc71fa8ea1aeac77473ce3be63fc60c0f5d188f27b10458feea136

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    cd33f14888d160eae603a697a5a6dc3c

                                                                                                    SHA1

                                                                                                    8de7afbb1d68a2738df4481c18be1cdd0193f89b

                                                                                                    SHA256

                                                                                                    09ab3a7dd9e1e5ab1cd7a10e6671c416610ff9749a0b21e4674ea1cb18f7a734

                                                                                                    SHA512

                                                                                                    30bdde0f11ae646adaa9c4a6a54d469d897e37477a6e3606f00fd4efe0005e8a68011949334df81bd67d719fd8e7915a7bd04b532836fd2805394d8082a71400

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe580683.TMP

                                                                                                    Filesize

                                                                                                    353B

                                                                                                    MD5

                                                                                                    c74abd9842ae6e30a35c9cf897743f40

                                                                                                    SHA1

                                                                                                    a013f925f2f2ac35e2c4e55eb6a2f15a9cdf9f90

                                                                                                    SHA256

                                                                                                    eb7895e77b64f52210bc064470e80be7b59df9144492bcde1f7f7de44dd1c98e

                                                                                                    SHA512

                                                                                                    a655e42f729da9cd82015b22976e79ca2a04ecd61b637625c47f72adba56844d432bd0250f1e2927e6ee3d75031810109b55e4bc12e7a7ed2518743c81fd8939

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                    Filesize

                                                                                                    23B

                                                                                                    MD5

                                                                                                    3fd11ff447c1ee23538dc4d9724427a3

                                                                                                    SHA1

                                                                                                    1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                    SHA256

                                                                                                    720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                    SHA512

                                                                                                    10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    111B

                                                                                                    MD5

                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                    SHA1

                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                    SHA256

                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                    SHA512

                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    91f5f9ad3375ae964adc629c09020be8

                                                                                                    SHA1

                                                                                                    7d25be6cdf3a1bae66ec75177871fcd23e391541

                                                                                                    SHA256

                                                                                                    064b282c9aeb31495abd234dcb7d78d3e2d278bc48817ee80e344397e42ed449

                                                                                                    SHA512

                                                                                                    bbb88d44d3ffe02575482f07023bf73b8429ef7900b42379cc0e1556005b25661f748b7e0fa33c4cd5aac63a0814fa466283a62e158752aca3bb62a58719d275

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    b0dbb46fa99f95e24882f9817718e65a

                                                                                                    SHA1

                                                                                                    72f28fc28363bd661072c6fbefcbb0992a00758c

                                                                                                    SHA256

                                                                                                    33b8597aba18f9c907898dccc1ccb13b91b5fc4f7d5cd3c1ee893dbfa54bc7d1

                                                                                                    SHA512

                                                                                                    f80d48a8545c39a6436999a832a0c14e3fcf40df44475da7c8567d4cfafd9c3f29f22e6a2c39c38170e87b00bd6c83046fecd3c8d3cfeb007ccdb55c80471b2d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    856c002eae4a3037e7b6682b32ea167b

                                                                                                    SHA1

                                                                                                    604d20da04666c66babf85c2ca09ed68eb1d534b

                                                                                                    SHA256

                                                                                                    eb40c2388200e30d2c6b61d7d28ff7fca34b956018ba86fc5623ec8b5b5f7b48

                                                                                                    SHA512

                                                                                                    2a5b8670b7c019ed337a1856ad86c8deb700ceb162ec080c4e29172d2f3f46935bf16a0f129ea4b29f99225f90875cb3821c537fa9ae30cd324f67c87e569332

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    fb17b0b42df722729a11a57ad469334b

                                                                                                    SHA1

                                                                                                    c48edc26c250974eb706b5fa4207625932d45e61

                                                                                                    SHA256

                                                                                                    a4dc108aa5edadd9dd414939d72608b43681bc6ce30a28c576915e0f40fe17a7

                                                                                                    SHA512

                                                                                                    6bd890140414dbfa2adbc197a771991d815090bbd2acaadc24d6df9bc0a6f237387fad1f246add5e9cffa16d3f9e086d52e62bab45b7f6bd41f1aba73ef90201

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    MD5

                                                                                                    121510c1483c9de9fdb590c20526ec0a

                                                                                                    SHA1

                                                                                                    96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                    SHA256

                                                                                                    cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                    SHA512

                                                                                                    b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    89B

                                                                                                    MD5

                                                                                                    6efd25e9969c70c2451117c119fe9f8c

                                                                                                    SHA1

                                                                                                    5e42adc729e631a6f620d2bb27cf966567db1b32

                                                                                                    SHA256

                                                                                                    0ca8b73622179ce0552754bbd866ffef09395323cb3280281a855e8053950b37

                                                                                                    SHA512

                                                                                                    1bdbf7a7a68f6834e408da57ae138d35b5cf889148b5273495b9054518126daae2019e789e9e57ce7dcb09b120679278cf0fa6c5cd5d304c6e1571de467a30c1

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    146B

                                                                                                    MD5

                                                                                                    1045205ca6c5176d2d86f8669523fad5

                                                                                                    SHA1

                                                                                                    2333f53684312c97bc5e7e427632c72725e905f7

                                                                                                    SHA256

                                                                                                    7a4b03e948430e0282a3f5be88f73e5c5431fe5afaf1b7b5cf0d8a10c6db9362

                                                                                                    SHA512

                                                                                                    e156b0aa070b15e880842caece5890a4b8119eaf090e8b94af9bf10cf846dcda06a5ced8fe14969bee0fff360d9933959b41ba85a0866b89f3ba68e09e882bd2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    82B

                                                                                                    MD5

                                                                                                    e7d05c164b559ac85ea044c2e9f20322

                                                                                                    SHA1

                                                                                                    984ac8d92b1092cf6ba3bab29f5617a2cf37767d

                                                                                                    SHA256

                                                                                                    2cb49ff99a918f37146a769a21fc4a9878c9fde409edaa2634b91195e01ffbd6

                                                                                                    SHA512

                                                                                                    261b7d3673bae1e79e7a7c88f66d2f09680a53e579f8a312fe69d94e67ad012c8ee485a3e966960de15a1811b0acd9e8f89c3d620679be9d3e1db8e187d21ce4

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                    Filesize

                                                                                                    83B

                                                                                                    MD5

                                                                                                    3d22c3db469348bbddb3e9ac59cc4d10

                                                                                                    SHA1

                                                                                                    2203fd11ce75c8e144fe593b5da1f4c952203b01

                                                                                                    SHA256

                                                                                                    7d594ec24c1165302a715f1a7a04dae6462f9fb6a3d57d871d4bb2ce31fc1f62

                                                                                                    SHA512

                                                                                                    f63d360adf9913f5c3d57d4952123fcda8a6bace52a889e8e9780a1005e55307562448b6b601ea716b6e814a1362ae35f4d5a2f5d2df1e588b2a8eb9fdf6515c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    96B

                                                                                                    MD5

                                                                                                    fc4b66760c94e3fa9709c0a9a9a584d4

                                                                                                    SHA1

                                                                                                    e25e35cbe90f99bbd056dd1495ea21b3ddd11953

                                                                                                    SHA256

                                                                                                    eb11c37237a6390a81fe2c31d47129195eaa736dc1a958b970fa50e4122ddbbb

                                                                                                    SHA512

                                                                                                    55d67466f8c43f1bf3f22876980fa5ea475bac06a1187235d215116181528411374bebc10bfae24345c1132bdb76d77267662efe65ef1fcdb1c462cbf6213d16

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a803.TMP

                                                                                                    Filesize

                                                                                                    48B

                                                                                                    MD5

                                                                                                    9d2fe42651343e30cd0a078cde9476a2

                                                                                                    SHA1

                                                                                                    ff92b2ee24ab72ffb845ad8a2a39e25c7e1c9772

                                                                                                    SHA256

                                                                                                    92e3b247f1ed2cdea7e50d54f9f4b77b8bc432bc35afe5d0679236041e556b09

                                                                                                    SHA512

                                                                                                    b7622311a129b2b2a8f139e4028337ec7651495e4c456e27b5745962e319d0b9206f16a46b23f196c7c1576c379e63bf1e5f9ad737ea7ce17a6d4dcf6f6578ab

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    8366b2163b2ff6f56caeb458ee3479eb

                                                                                                    SHA1

                                                                                                    92da3f8361adae54f358fc5b81f086b575d60f7d

                                                                                                    SHA256

                                                                                                    392290f3c62a2d2a094a8dce6d0d53640b963e901a8c2b8b307ff1857b13c412

                                                                                                    SHA512

                                                                                                    2ab6404d8cdc3a9d34477ae76d2722b43b5858cdfe993746cc4b53a951795151a12a518bc62c86c3e92dea0a5f3c59bb27ff4dab12d13683b6517252d533832d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    234d7ca82fa1254a2706102b2e70fd56

                                                                                                    SHA1

                                                                                                    45e2de9cb0ee08786ae79bb71f3132b897f40946

                                                                                                    SHA256

                                                                                                    c7723833b5d0b2e08f12f0ef5473abeb86ed7a0d2a510e12bf46b3e5b839d07d

                                                                                                    SHA512

                                                                                                    3ee6a019ad71be79722c05a22e5b80ccc5c015f803511aced10a696a1ca8f1ad4108200ce33b87ff2626ccc109545c46ace4f27adac035d385cea8c7ace35a8c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    29257824cef38352007d57830a08900f

                                                                                                    SHA1

                                                                                                    cb01c50f24d0cdf33ad5e837f263b29aa9932c9a

                                                                                                    SHA256

                                                                                                    c70d41f61d7c018d6f0eba932774ec62b92948c16dbb2c7f149520ae591e3f61

                                                                                                    SHA512

                                                                                                    d57cc1b2e142bf48b72d901d66a6f60582b905cf8ee1451238d8734499c7812fe9bcf1b697e669c2f0039001eb15fa368734790bed7dc67746963c68007d4e13

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    c34f9922d84cf9d0a46cdd3515c416ee

                                                                                                    SHA1

                                                                                                    6b68a087d779d00f834f700b5b1bd53ba663e309

                                                                                                    SHA256

                                                                                                    84e09d87291bae7bebd4501b349093de75138d72cf237c045d641f3a9567c680

                                                                                                    SHA512

                                                                                                    a1ef4d488d413947379b1db877922e8f65d3dde601651d0abf7dccf7f75918c7f745b168ce6da261511a74476091c8a983a295428fccd3f4235c0cca5a3f4e78

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582258.TMP

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    2321eb41213b990a54e1c0312adfa636

                                                                                                    SHA1

                                                                                                    1afe86cc3d8cdef2083d03c73c2c77f9599656df

                                                                                                    SHA256

                                                                                                    7cca4abebb7ae6235ff44a871e43709f300ed5b9eb72b5ab34e3706a5e8b20c5

                                                                                                    SHA512

                                                                                                    149057a6047056da7f3555ebe1f829a9f29c62589489cebcf18615bac5b9db377d4b720b9bafabfdcdae3b8e901c2a0d4cf7bd800311503ad600b7f6897f238c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                    SHA1

                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                    SHA256

                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                    SHA512

                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    a169d1a6e73e1e4cba6ff58cf09a5b35

                                                                                                    SHA1

                                                                                                    a9a6e7eee341a3873b8be18df1e6ce8c2f16e20a

                                                                                                    SHA256

                                                                                                    85f536ef445f353eda9f2c0d6272ad8781e31522a3c6b0b550a0b65294ce8c4f

                                                                                                    SHA512

                                                                                                    623e754b19cb11c3e8dc4ff9a68ec2b7d826f84ba712e4495c9d13b0ebe4d408c6dd8b26db03c86d172226dc4b5604f98d86eb8526ed5c3d4bdf18ff84192af9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    1711bdc2d66e9b4d19a1ab6bb02faaba

                                                                                                    SHA1

                                                                                                    305d92f3c0c18d15914d083821a3229c73079375

                                                                                                    SHA256

                                                                                                    632d1f31b373a6f0f8ee66d4b7f0b8acb34b38656883ac5819105562ffb56b35

                                                                                                    SHA512

                                                                                                    93398e2f64c7dd03e1a37f6dcfa3f2a06f4569a292ec337aa6ca69ac7ed939e604736540bf967ea13aa5f7d1fd3c76961ea995b536fbc6093874afed8f169ed5

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    d5480f2649daeacf4c0cee93778d2b27

                                                                                                    SHA1

                                                                                                    0cc0efdf6436e6181dae7909d290f5b0a4d7c412

                                                                                                    SHA256

                                                                                                    6f6cd409f1c185d40469da661ef736bf6d82e10e25543f7ab00d4a7df267f6fc

                                                                                                    SHA512

                                                                                                    9fd23b33e78cf801e1ae35086f43ee4407d6be7a7acc05aeaffc87d94a30fe84f5ef7f273f1e3a33b460479b1fff7e5626077872d625f674877e77e647c4fd7a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    0d9b8e177e031a6fd2cf08205252630a

                                                                                                    SHA1

                                                                                                    f2931dbece3e452d072a06cf96e7ebab7b37b20c

                                                                                                    SHA256

                                                                                                    8c42f2906ea7a7fa1eb01d22e2bd886a64aa591c2e5d3e6e55c6ec0a38adf70d

                                                                                                    SHA512

                                                                                                    b1cb227856cdbf551043194f5c595a8fbe4902037dfd35c3251e77322ddbbca32b57fb43f3bc97cfe70d9c6fb99f0eae2c925cfe236aea07d5c918fb0cad10e9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    3ac6ceeedcd217dcb7ed73b1ab567907

                                                                                                    SHA1

                                                                                                    8805c0052245a0b5a1558a5654080d224727dc8f

                                                                                                    SHA256

                                                                                                    f8731ed6e03fb1f0b0e5000f9be93c88618f7215c1323a91b59b8e95d260507f

                                                                                                    SHA512

                                                                                                    a7268a182809a2b03cee80a3102a3181120e7c4645acffe1d30abe6dfa684d53002cfd8433b97e4fd0f17f762adad56b258119df37d38ef3f657dbc72f649d0a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    858f791373e63b5bb5e6eaae61828c64

                                                                                                    SHA1

                                                                                                    4c08a64f7996eceb06564778b2a617520c32fbe7

                                                                                                    SHA256

                                                                                                    73d93e7f267263240e036f4daf73d74765be8b53e73fa7e7ed8b6107b1efd9eb

                                                                                                    SHA512

                                                                                                    4e02792006526c0b70154132a0acd53d486b1ddec1879d58754532ebf550476724a598b2d7c329348e2fceb2828e0e7b25cf27afc162bf4a26aa5149955f5854

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef4db2ac-df13-4092-b847-be5608f94482.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    27aca726c0b71ac91142f77b4e062d5f

                                                                                                    SHA1

                                                                                                    4e0ddf259ef3ba1d5d940bbaad8aadc8df44e6f9

                                                                                                    SHA256

                                                                                                    f29c393df8b123004ab390bab0ee96649420f14d7b8aa6631c037403c6dbcb01

                                                                                                    SHA512

                                                                                                    edb8a45bc32dc6b63c1ef796728673096c50abc2a1230fec9a9ae8a56daee48e3b13884a13d485298b21e796afec68f2283786b098e517deffc7020f9481ee5d

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                    Filesize

                                                                                                    2.7MB

                                                                                                    MD5

                                                                                                    da044811ca4ac1cc04b14153dccbbf37

                                                                                                    SHA1

                                                                                                    6495d9b495010f8c79116e519a8784e342141b8a

                                                                                                    SHA256

                                                                                                    7c31979024f0d5873af50e66b541135b095a0958d7c0203e01f366cfb2a8d1b8

                                                                                                    SHA512

                                                                                                    0352129b629768f0192f58e43ac097758f3aae0236de363638ce14a994bdb0f17e31882f6ae7a93643222f542ffb21cf492d3c18dbaf6ec5822c45a8c2ce33d5

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EO6sz80.exe

                                                                                                    Filesize

                                                                                                    3.5MB

                                                                                                    MD5

                                                                                                    69a6aae3c1c5797f55c8acb8f239e15c

                                                                                                    SHA1

                                                                                                    f5bd1ec93db04490101eb6e654718dfd30af8bd7

                                                                                                    SHA256

                                                                                                    ea05f86a823575a454b1261e0d428bc56b54898c2320272c67151e7198aa816b

                                                                                                    SHA512

                                                                                                    68c5d57e837e9c8879828395cf0b138f16d72d214fbfff60e1c2637f3a6c819b92d3c119131cbbb6faf7c2ae2fc4d2e17801c0b8e7b844bf0298f1e99b8423a4

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QB0Jd67.exe

                                                                                                    Filesize

                                                                                                    851KB

                                                                                                    MD5

                                                                                                    7b90b489195c97a414276798329107fe

                                                                                                    SHA1

                                                                                                    3dee0f04c05fce32feb383ed502bf8ad5b639170

                                                                                                    SHA256

                                                                                                    d7495f42fbf28aa0e603aa6ecc29a4bcc15488f73cfee771b3e64b31c0c5c66b

                                                                                                    SHA512

                                                                                                    e06b7c4cf6f933a1b1bc6e8cc22dfedf5ae2e0441153aef675d87c814ca0ebb650fc54ca228f75eeb59a860f5232e05d37fdb34415fc3faf3621c7621da5876f

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1qG14AF4.exe

                                                                                                    Filesize

                                                                                                    895KB

                                                                                                    MD5

                                                                                                    2e48c0375a153566d5084c5a73282be4

                                                                                                    SHA1

                                                                                                    f5ce4fe2d8ef2b2324f1c2ea7bdbcbddd700d66b

                                                                                                    SHA256

                                                                                                    5429d76bc699f1028d526abd30d006671c9a856fe15f2b003739bd65aa5adefa

                                                                                                    SHA512

                                                                                                    1073df30b3cb1ed56d1815b64bea60210aa230f49a7d2239903a4f26c8819c72fa417728bb3be09edb3f73cb2908cc4f5c66c9816d46484c825cfb3220c006a2

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lA5073.exe

                                                                                                    Filesize

                                                                                                    448KB

                                                                                                    MD5

                                                                                                    700a9938d0fcff91df12cbefe7435c88

                                                                                                    SHA1

                                                                                                    f1f661f00b19007a5355a982677761e5cf14a2c4

                                                                                                    SHA256

                                                                                                    946583a0803167de24c7c0d768fe49546108e43500a1c2c838e7e0560addc818

                                                                                                    SHA512

                                                                                                    7fa6b52d10bcfc56ac4a43eda11ae107347ba302cc5a29c446b2d4a3f93425db486ed24a496a8acd87d98d9cfb8cad6505eb0d8d5d509bc323427b6931c8fff8

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVScGjlYZ10IIuB\2gNAzLexsnrkWeb Data

                                                                                                    Filesize

                                                                                                    92KB

                                                                                                    MD5

                                                                                                    ec564f686dd52169ab5b8535e03bb579

                                                                                                    SHA1

                                                                                                    08563d6c547475d11edae5fd437f76007889275a

                                                                                                    SHA256

                                                                                                    43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                    SHA512

                                                                                                    aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVScGjlYZ10IIuB\TJ1ie4iPKN9BWeb Data

                                                                                                    Filesize

                                                                                                    116KB

                                                                                                    MD5

                                                                                                    f70aa3fa04f0536280f872ad17973c3d

                                                                                                    SHA1

                                                                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                    SHA256

                                                                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                    SHA512

                                                                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                  • \??\pipe\LOCAL\crashpad_1308_UWEASBGRWQDUTCXK

                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                  • memory/1440-890-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/1440-997-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/2768-123-0x0000000000A80000-0x0000000000B80000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/2768-311-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB

                                                                                                  • memory/2768-129-0x0000000002600000-0x000000000267C000-memory.dmp

                                                                                                    Filesize

                                                                                                    496KB

                                                                                                  • memory/2768-136-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB

                                                                                                  • memory/3540-995-0x00000000026C0000-0x00000000026D6000-memory.dmp

                                                                                                    Filesize

                                                                                                    88KB

                                                                                                  • memory/4356-1721-0x0000000074F90000-0x0000000075740000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/4356-1740-0x0000000007550000-0x0000000007560000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/4356-1723-0x00000000005D0000-0x000000000060C000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB

                                                                                                  • memory/6820-325-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-550-0x0000000008780000-0x000000000879E000-memory.dmp

                                                                                                    Filesize

                                                                                                    120KB

                                                                                                  • memory/6820-871-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-317-0x0000000000230000-0x000000000090A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/6820-339-0x0000000077AA4000-0x0000000077AA6000-memory.dmp

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                  • memory/6820-800-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-737-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-736-0x0000000000230000-0x000000000090A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/6820-680-0x00000000053A0000-0x0000000005406000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/6820-364-0x0000000000230000-0x000000000090A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/6820-612-0x0000000008C90000-0x0000000008FE4000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/6820-324-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-323-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-382-0x0000000007730000-0x00000000077A6000-memory.dmp

                                                                                                    Filesize

                                                                                                    472KB

                                                                                                  • memory/6820-884-0x0000000076F20000-0x0000000077010000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/6820-883-0x0000000000230000-0x000000000090A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/7336-1722-0x0000000005CC0000-0x0000000005D52000-memory.dmp

                                                                                                    Filesize

                                                                                                    584KB

                                                                                                  • memory/7336-1724-0x0000000005FB0000-0x000000000604C000-memory.dmp

                                                                                                    Filesize

                                                                                                    624KB

                                                                                                  • memory/7336-1720-0x0000000006320000-0x00000000068C4000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.6MB

                                                                                                  • memory/7336-1725-0x0000000005F00000-0x0000000005F10000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/7336-1707-0x0000000074F90000-0x0000000075740000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/7336-1728-0x0000000005E90000-0x0000000005E9A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/7336-1706-0x0000000000F50000-0x00000000013EE000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB