Analysis

  • max time kernel
    79s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2023 03:12

General

  • Target

    5d6e898b8f84dceeb3ee87d9002fb410.exe

  • Size

    3.6MB

  • MD5

    5d6e898b8f84dceeb3ee87d9002fb410

  • SHA1

    02b5f37971ee1ffd68bf748f09f9d7c581de8907

  • SHA256

    fc1af115d47f4f6f00b3c2a06c64b4b580b76a16f8e1c122670ced300f4abf57

  • SHA512

    bf849e0a1ad639c1e8b21145ba7e7bfce6bd55bb1a39e6183af0552c795051638f10fcd06f71872ad4b632b77f2aea3ecd5e8d629d7482a4cf11ea2cff12d0cf

  • SSDEEP

    98304:hjBhleixKsyEmLl+ylqiSxcmni/uDEPnJWc6iw:5Neicsy1459niuEPnJW

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 5 IoCs
  • Detect ZGRat V1 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d6e898b8f84dceeb3ee87d9002fb410.exe
    "C:\Users\Admin\AppData\Local\Temp\5d6e898b8f84dceeb3ee87d9002fb410.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tF7pU94.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tF7pU94.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uZ2Gp51.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uZ2Gp51.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1jv31Nd0.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1jv31Nd0.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:644
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2416
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x150,0x174,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
              6⤵
                PID:1120
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8867405414644360248,8466900627934193811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5516
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8867405414644360248,8466900627934193811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                6⤵
                  PID:5480
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:3716
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                  6⤵
                    PID:4580
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5448
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                    6⤵
                      PID:5440
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
                      6⤵
                        PID:5688
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                        6⤵
                          PID:5228
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                          6⤵
                            PID:5176
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                            6⤵
                              PID:6864
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
                              6⤵
                                PID:7100
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
                                6⤵
                                  PID:6724
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
                                  6⤵
                                    PID:7188
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
                                    6⤵
                                      PID:7256
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                                      6⤵
                                        PID:7612
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                                        6⤵
                                          PID:7436
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
                                          6⤵
                                            PID:7708
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                            6⤵
                                              PID:7960
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
                                              6⤵
                                                PID:7984
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6244 /prefetch:8
                                                6⤵
                                                  PID:7120
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6240 /prefetch:8
                                                  6⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:6792
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
                                                  6⤵
                                                    PID:8040
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
                                                    6⤵
                                                      PID:5600
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7676 /prefetch:8
                                                      6⤵
                                                        PID:6356
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7676 /prefetch:8
                                                        6⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:6848
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
                                                        6⤵
                                                          PID:6636
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
                                                          6⤵
                                                            PID:5144
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
                                                            6⤵
                                                              PID:4800
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
                                                              6⤵
                                                                PID:5564
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2592 /prefetch:8
                                                                6⤵
                                                                  PID:5940
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1792739048361999595,8939591745189188915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
                                                                  6⤵
                                                                    PID:4388
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                  5⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2568
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                    6⤵
                                                                      PID:4136
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8868342766755548412,17133960771843416685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                                                                      6⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5540
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8868342766755548412,17133960771843416685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                                                                      6⤵
                                                                        PID:5532
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                      5⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4548
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                        6⤵
                                                                          PID:1208
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4025499630358533507,1315424554441065837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                                                          6⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5564
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4025499630358533507,1315424554441065837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                                                                          6⤵
                                                                            PID:5556
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                          5⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1160
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                            6⤵
                                                                              PID:536
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14241590924702162897,15607924033604638565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5496
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14241590924702162897,15607924033604638565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                                                                              6⤵
                                                                                PID:5488
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3824
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                6⤵
                                                                                  PID:4940
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9256067596326918041,14628729103073938116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5584
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9256067596326918041,14628729103073938116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5576
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3500
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                    6⤵
                                                                                      PID:3560
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2005118059352949966,8745287397364721424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5524
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2005118059352949966,8745287397364721424,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5508
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1612
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                        6⤵
                                                                                          PID:3612
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12633504248189222007,1501363082385613536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5788
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12633504248189222007,1501363082385613536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                                                                          6⤵
                                                                                            PID:5312
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4948
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd35046f8,0x7ffcd3504708,0x7ffcd3504718
                                                                                            6⤵
                                                                                              PID:2600
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,138012100755222901,4799424176921956219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6744
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2bV1100.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2bV1100.exe
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:8128
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 1076
                                                                                            5⤵
                                                                                            • Program crash
                                                                                            PID:7908
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WK439mQ.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WK439mQ.exe
                                                                                        3⤵
                                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                        • Checks BIOS information in registry
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Adds Run key to start application
                                                                                        • Checks whether UAC is enabled
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • outlook_office_path
                                                                                        • outlook_win_path
                                                                                        PID:5860
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                          4⤵
                                                                                            PID:7524
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              5⤵
                                                                                                PID:7436
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                5⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:7428
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                                PID:6356
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:7904
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 3052
                                                                                                4⤵
                                                                                                • Program crash
                                                                                                PID:6464
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6gY3FG3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6gY3FG3.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks SCSI registry key(s)
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:6968
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:6676
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:6760
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8128 -ip 8128
                                                                                              1⤵
                                                                                                PID:7568
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5860 -ip 5860
                                                                                                1⤵
                                                                                                  PID:6248
                                                                                                • C:\Users\Admin\AppData\Local\Temp\E606.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\E606.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:5380
                                                                                                • C:\Users\Admin\AppData\Local\Temp\E8F5.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\E8F5.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4608
                                                                                                • C:\Users\Admin\AppData\Local\Temp\F5D7.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\F5D7.exe
                                                                                                  1⤵
                                                                                                    PID:8324

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14355842-ee71-48c1-8bda-ee0ab09c406b.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    7e8be1561a078bfce27803908ff7ad35

                                                                                                    SHA1

                                                                                                    a1855bd589ca8ff3d8922c62a9a2903e6aa0b528

                                                                                                    SHA256

                                                                                                    e437d6b2e5ee3b51535f2304a667af465c660faa44f8d854753747bc35481821

                                                                                                    SHA512

                                                                                                    72cc627b899390ef395697cb80a28fa02672c6c76fde05ac83b1a145ef5d93aed97f424bc84a7eb7b0bc59521923507dcd373bc4f3354aaf0d953097528b88df

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83b784e9-c765-4289-bf82-50d5d0996921.tmp

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    a19217a2f2e9b76e28ff3795b9584382

                                                                                                    SHA1

                                                                                                    82bf83ab67c417dfe96ff96172dd4cb573edbebd

                                                                                                    SHA256

                                                                                                    6b9c5cb4d3f4a82e2b5068bbb25cf15033ac088be05d00fa9e258b91ab11ab3a

                                                                                                    SHA512

                                                                                                    f3ba91a7dd45e07884e75f202e261337d20adf0609ec94fb14973453231998c2d2a16dfe6f79de1f5f3f42c69e2a873df8debe8a4090302715ec37ece6c1d268

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                    SHA1

                                                                                                    8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                    SHA256

                                                                                                    d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                    SHA512

                                                                                                    6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    efc9c7501d0a6db520763baad1e05ce8

                                                                                                    SHA1

                                                                                                    60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                    SHA256

                                                                                                    7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                    SHA512

                                                                                                    bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

                                                                                                    Filesize

                                                                                                    201KB

                                                                                                    MD5

                                                                                                    e3038f6bc551682771347013cf7e4e4f

                                                                                                    SHA1

                                                                                                    f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                    SHA256

                                                                                                    6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                    SHA512

                                                                                                    4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                    SHA1

                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                    SHA256

                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                    SHA512

                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    34dab80f31ca40bf27d9b5285048077e

                                                                                                    SHA1

                                                                                                    d84ce34389ece33e759bf356c0dadd5352e153a3

                                                                                                    SHA256

                                                                                                    928235db289127c79acb20cf3587f714a2b09a37455a35a2468318a4d3037122

                                                                                                    SHA512

                                                                                                    9fe2b0705648b652d7fdb5b20f9368871d6a5afb584f9826663fa3de6f22024fcc7845d553a24ca8746d5ea7fd0285b856d2010973924bff8e3564b14f77460b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    3007e520b9299b064358e5c7a2427c32

                                                                                                    SHA1

                                                                                                    080167251d778b23efc4495d51d2f40488a45a73

                                                                                                    SHA256

                                                                                                    46aec492443ef3560cc705db317a502e402c39c5e8020c18b5d7ade1c87024a9

                                                                                                    SHA512

                                                                                                    c7e89c50d9e79822c7770f2139dfd7130426b7d58c6cc96a6a74e2da39c85f85941e25d4a317c90859b0ac7c1fce71e69d2a94760a5b71cf97b81442ebd64c36

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    3e0cca1f929c3aa5782dd89edf5eb054

                                                                                                    SHA1

                                                                                                    ee81adad335cd09d871d0d4628bc6089fc9bb8fd

                                                                                                    SHA256

                                                                                                    0c2d82f9047932c89ed7a7150c0c874723cb3d85dbdd629666cd5f5b6ff1c0ee

                                                                                                    SHA512

                                                                                                    c964e0585419901fefddb4957e01dfb539373c9e06ba55e7bff747be818c6002b130839ced539ddbf1f4ba26e1ef731d536fd1d50917bc78139ca78c8c7b76bb

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    0399af9798c87ed27c2269ff5e87f141

                                                                                                    SHA1

                                                                                                    c102c394f37d3ec262a5fd49512e2639379ea50c

                                                                                                    SHA256

                                                                                                    3efeb6b09e8c266a1b9a87bc506375f08d5e46df09c85f2b02c63fec27bc0394

                                                                                                    SHA512

                                                                                                    5742b6b3eddd4f9a3ddc7234611ad2164bde635c392dc862719bed703a1b06c0dfbd7cf51f2d2f40833c6c74647009c0f7fac78176a68770a74dbe1a22afe50a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    fbdeb34d5908a4c78eca2251c21fe9e4

                                                                                                    SHA1

                                                                                                    1bbab09e8abf0801e680a002c2b5b72d4b31e921

                                                                                                    SHA256

                                                                                                    efb6ebe4f403e44135de1ff43c7724fe40b7c4d7149e02734dab305f887788ac

                                                                                                    SHA512

                                                                                                    523f833c0f0b798fbf55d98c634cce0c1b11b1418c50ea77d863e1113f0666edc23d7741663a9b958eb673acd209a5942b094c169e943bd84df084a4b0a2b82e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    c54ee7397fe8ada7098140ea72dd9f89

                                                                                                    SHA1

                                                                                                    26af03daa3557b3b3ed5836df397d526d3fc5367

                                                                                                    SHA256

                                                                                                    d1d3e31d35ce48b29d0480fc6615f5e99ec6dd729830642f5127fe2caf8a45d6

                                                                                                    SHA512

                                                                                                    ab84622c1f462ecc392cb3abbc25f389e2c367cf7b18c585f1230bd97c3846bf924d5aab4940921cc0caa28a3d3ef202e7377519ac66739888a60e015ae497ca

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    1556cad316416cb070746d133cff5556

                                                                                                    SHA1

                                                                                                    cf93283b84d7ac714b8571879d04a2e36c2bec6f

                                                                                                    SHA256

                                                                                                    114da98c6ad84d638efe92e4085bd8e44960f9864fa093eb44d02fd11d3d8020

                                                                                                    SHA512

                                                                                                    f138879eba41498841d7a1948993905ecf42040c3a36bd4e649dd2132ebcb11c17761b5836112afe84cccb1c71fc054435c76432593490f604bd891ff164e3bd

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    a687d1e8b1d7cce60f15da123b2bdbf2

                                                                                                    SHA1

                                                                                                    ae8a8bad06e35b14cca33cf0fa535c5b1bd2a7cf

                                                                                                    SHA256

                                                                                                    f07ee0db5459e8a4027d98189cab3acf38f6b8752f18364285cfad7888d198ec

                                                                                                    SHA512

                                                                                                    71878d87270c708a2bf57764a541f088690607f2c57a7e81a4d59b247ef93df2d7477fc99c48b5aa427280b9f3658ab542f2e2104bc06a20a4c53e339050c280

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    393B

                                                                                                    MD5

                                                                                                    3e2a1a617708137932cbfa811118fa0d

                                                                                                    SHA1

                                                                                                    031991becad96798d52b6a5f90c303f22c492e6a

                                                                                                    SHA256

                                                                                                    756fb0aa336845e0b33cf9f1e8692afa1a56b8d8a6987c9df06b4799b3354c09

                                                                                                    SHA512

                                                                                                    b8a418d0fda9b1fc2cab70a26afd92f8f99d2f1b6b1c4baaa520562767af6f385093fad3ca0ff4330dda937464776f04e1179017d63f773e905ee88f2635311d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                    Filesize

                                                                                                    396B

                                                                                                    MD5

                                                                                                    90037e24e1393db5d8d61a94171659c6

                                                                                                    SHA1

                                                                                                    e87e29bf712c5600d6967edc452a95d8e7010949

                                                                                                    SHA256

                                                                                                    d7d6c9c5e2029d7b946603fd28088f6f16cfeafd33c0dddb7b00d5a4d77ae573

                                                                                                    SHA512

                                                                                                    3bd78bb1aace8503c5ef70307529d172f6a95d928fb26953656b37df6ba9937e95b733c3b3552bc616968bd8d2818c25d9b10926420a78ac6409e2fb8c5d7835

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe58393b.TMP

                                                                                                    Filesize

                                                                                                    353B

                                                                                                    MD5

                                                                                                    10562f785bb31b8a37f27775c309dbe9

                                                                                                    SHA1

                                                                                                    c3ffa9281dddbc2d01450c9dc93bd95462f52c45

                                                                                                    SHA256

                                                                                                    3ca9af8af9f2f937ce42830ca834563a30dd293f5604e3b32661e79316de9a0c

                                                                                                    SHA512

                                                                                                    cc2b78ac2733926e6b21a9bf21d288d1eddbbb8b6c37ee9f691eb3e7939d1cb4f0dc03f94ff521d1959dc7f1b215c2dd11e19ae9b2a09cb84ef82062bf4bfa82

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                    Filesize

                                                                                                    23B

                                                                                                    MD5

                                                                                                    3fd11ff447c1ee23538dc4d9724427a3

                                                                                                    SHA1

                                                                                                    1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                    SHA256

                                                                                                    720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                    SHA512

                                                                                                    10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    111B

                                                                                                    MD5

                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                    SHA1

                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                    SHA256

                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                    SHA512

                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    0bd07e920a002f53ea677ed03d5dd5ae

                                                                                                    SHA1

                                                                                                    12be024e473fc570819d263dbcd27a56c6322b4c

                                                                                                    SHA256

                                                                                                    592b99068e3d8c7705359705846233fb505940cc16b05d9bdee8672e26599aee

                                                                                                    SHA512

                                                                                                    1c82ca1bf7095f3ebafc47dbc78650e1a16a04827f346db7d8f4355644041595b342acfac6ec15763e36d8b894ca83f5fbeba703e71a7663172ee04864efc239

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    1ada8a67eba4e79ee8118c43f245bb04

                                                                                                    SHA1

                                                                                                    f8182dedd528a633dd85347cacc71930879b38f0

                                                                                                    SHA256

                                                                                                    c11621b390607b62916241a720455b1b3d6df88e64ba508c2949f15eeb9c95b6

                                                                                                    SHA512

                                                                                                    6cf7d1758ba0c863445c67aafa094861f6cea1f0d152c1fb79b2dd806eb23ba0fbe734f0760aeb23135334bcc847df6d1821ecfdcf9247a6bc1eb4973c32bcb2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    cf326437dad5953cf81b67f21cefeb7c

                                                                                                    SHA1

                                                                                                    c6d5b86dd081b0361876898bbbc5b9e430966fb8

                                                                                                    SHA256

                                                                                                    b3c9bfd16bdcba194dd849d9289e2f486397fd28445e96122d40696a98b5375f

                                                                                                    SHA512

                                                                                                    d4b3192c424a6069aa75e5379be89c26f1a4cf07f7ed46d09f576760dc100518a5f2664c26c25bef76f0cca910225fd601c646cc92c361d7e3083342dd56ba38

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    a7a04fa4ef7db63519f6558bdd7bf608

                                                                                                    SHA1

                                                                                                    dfbc3c3a2c64987494aea7551801956d07a4c575

                                                                                                    SHA256

                                                                                                    a796292912176af74f7aa67c734d1f72a0c2106ac6e1e0f1a7b0e4c2dbefc09a

                                                                                                    SHA512

                                                                                                    2d28be6a69305bd3e73eef20ff88a20da9c3439e82ef626077f314a1cf449a5f2a842c63f7a30b1e148c4c25c90a9f24c76c708bc3bd9047d9d10f44ab89d3d7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                    Filesize

                                                                                                    24KB

                                                                                                    MD5

                                                                                                    121510c1483c9de9fdb590c20526ec0a

                                                                                                    SHA1

                                                                                                    96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                    SHA256

                                                                                                    cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                    SHA512

                                                                                                    b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    146B

                                                                                                    MD5

                                                                                                    828e6f80bdf60abf6bb05d0975395915

                                                                                                    SHA1

                                                                                                    7361ec8d49fc19c4b412a36b5f37218833ca0bd8

                                                                                                    SHA256

                                                                                                    aa377fb68811dd05fd748b87129070582e6fb9b85c539a0fbc58bdda92dce995

                                                                                                    SHA512

                                                                                                    d3a11523de809a98841d3d66bd8c3e4d29e7eef53ac88f7b582548c9a4a966cd3fbbffcb097599615a21bb1d0634ca4a9397b2a17db7daad3ba62d39ce8427ab

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    89B

                                                                                                    MD5

                                                                                                    1998207b5747f2af542b9ee3552ee6b6

                                                                                                    SHA1

                                                                                                    ebdfd9f1523064e358152cd062a814528ce92846

                                                                                                    SHA256

                                                                                                    8f354186e529ea1a9a1e5da07f7a26af83f14a292ae3e56fcb2134ecd913e37c

                                                                                                    SHA512

                                                                                                    8df12ae85826cc79a0d743770a2c1b254644ad3a1f46f8ecc10b7c16d356e5d5b145f98439c1862b81b2238a2ae9b82e870378b94bdeb47b77e91d19615331cc

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                    Filesize

                                                                                                    82B

                                                                                                    MD5

                                                                                                    e573864e56d81b893e861d7a32a5b39c

                                                                                                    SHA1

                                                                                                    35489fbf430597303cb2c0eb2f59132a7968faa8

                                                                                                    SHA256

                                                                                                    ff34b6d63e821969f8b8d5ee75dac1433abf7669f5a7e72e1a06b9b36bf03bb3

                                                                                                    SHA512

                                                                                                    0a2d214ca8a7f05c8d8adbe61ce27a92c8a1d1ef8884be9a75649f5db7b48c597c03e4310a1ce6ed31640526b9c25a1f182220ff78e4da2e1fcec67ca3a09b0b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                    Filesize

                                                                                                    83B

                                                                                                    MD5

                                                                                                    8ed60fdf7c82be42155f034d6078399e

                                                                                                    SHA1

                                                                                                    8302756bf20d1480a46845c3229bf7b25635b344

                                                                                                    SHA256

                                                                                                    146b27bab603b09dbca119109dae75123a13c119e89876a975b53df953364406

                                                                                                    SHA512

                                                                                                    0f39d7914b02eff15bb9192b29cce1f61484f81f63e7e89394766b01db4eccebef6b1f75114396855f9c4ed277a20534c655b7ce9a8f3e2be742c96ac1d79940

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    038d7c21f53fc6cd2c6ff4309f2306d4

                                                                                                    SHA1

                                                                                                    09315e2ec261d5676894cfcabbb61f951b119b47

                                                                                                    SHA256

                                                                                                    92e8391fa636faae5e30b1f6000b4b7190528b2bfeee87869e60edcc8d5eb99b

                                                                                                    SHA512

                                                                                                    2674e4500d21e1b0f0fdfa2008e4899248cd5ef358f71da7e175e2f9390035fd792b021ed7f6095227263ab1419a4b315ea9913d877589ff5aa9f70cf61bb39d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    5e6c2973240a90c4a0545692615690d3

                                                                                                    SHA1

                                                                                                    85db545afffa521a7cbcc8578ec12df50f2954f7

                                                                                                    SHA256

                                                                                                    bdc14c8206523adad77d39d74f1fb5c560df0824fdd0e494f561213fc67e86b5

                                                                                                    SHA512

                                                                                                    3c96a08451d97a3cdbecebccedffa2566a9f70b9406f73f126651f66b07d0e2b6d61c2b35b762394d1384be402a285f7022655216d26ee1d8bdb914c7657cf23

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    55a9229cdb0445ad1dbcd485ac7a670a

                                                                                                    SHA1

                                                                                                    5bea67c64c032e8e8c774d44c298559ba49edcfa

                                                                                                    SHA256

                                                                                                    f1f2e610ca549eb153a96e2eb88cdccedc5d70fc61b4e7cf3d50adfe0f00c672

                                                                                                    SHA512

                                                                                                    25107a58dc8354ed4786afaedad7e3261ac9d37e7886c14cda9359581cef3f96a827fd1aae921e2f83a0a12e692a17db474442487fc095d9da5ae1794bde7357

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    e40046345cb0601bd127319a1150b04b

                                                                                                    SHA1

                                                                                                    1421d5dad4f5ebd4d716830dcd3219e3760e1454

                                                                                                    SHA256

                                                                                                    62ad03aa5002c6fa5f7b5557f0a5081f74857c1eb7f3dc5da660ccec8e3783f9

                                                                                                    SHA512

                                                                                                    73bd9f2d23b2a1a72f018846be83f2772d78e39342fee8dadb7f3e294f07ebba24a0b6592b18077d0e45c56cdc72d0bcf55531efdca25038704aa698c702644c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    3cbdc2b72bcaf04c62c3b331b97008bd

                                                                                                    SHA1

                                                                                                    f9055006292b7415bb67742d1fc97d7eef964f15

                                                                                                    SHA256

                                                                                                    4e3a82b4aaf616f856f0cf6ddb2e27e7c3574496f1d6b8dc47bc26d98063f28a

                                                                                                    SHA512

                                                                                                    f39328a6a8ac195360d3b0d17491d6fa7d0bdf29ec878f5f2cc922faed583a0d5f3741c0065654dbf68df9e352671299704ec1ea2bd13b08d62cfad518a38cc0

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5855fb.TMP

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    f9c6d749d655656f64e15b5736f0122d

                                                                                                    SHA1

                                                                                                    467f0fc627ba311c7498e7eaf6f001808cece171

                                                                                                    SHA256

                                                                                                    9f27dbe66282848797533bcd6647ecb37a495fd4c8903097d1b5e7702cad1bdb

                                                                                                    SHA512

                                                                                                    b1f4159198922130028434874247ac4ff1ebe51481e7161077de318142c84e509161649a4896344caa1129d9a5757e65e2338caebf4612ab1efda2341e85e6b8

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                    SHA1

                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                    SHA256

                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                    SHA512

                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    e851998565775409d8b39b8e93b896f8

                                                                                                    SHA1

                                                                                                    bfb1da2d2934ddd7ebb1df11bb327be5cef7d930

                                                                                                    SHA256

                                                                                                    f7d4bda1cbe4b1e305af9c8654bb11260a19b15c5d9301c4fadc230a9ea4aa4f

                                                                                                    SHA512

                                                                                                    5f52489e4b99c52751a20ac4174ec988114c107b635554a5123df220bfd6413cde1ce2a0491bf2b0bf939ffc5eb294a754c1c9c722a034026e51ebe566204744

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    ab03fc4fc97672ae06232daf7868a4b8

                                                                                                    SHA1

                                                                                                    1c5b6e72e4f9b3f822a9069448b3b003c42bcb03

                                                                                                    SHA256

                                                                                                    8b57ea45150d5a46a314f8616c7264593ab6017b96208698d71a1f644e878739

                                                                                                    SHA512

                                                                                                    e5483232622d87c26a6fdb6f0839d0ea92395a63d7e58ba0e4423fdd98ef1a7949fd147e7b9f3f44f62e7d0af1361e0678e77fa2cd71dfffa1cbf84530871a8f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    79a78cc542fe3316f82f172fce1316c0

                                                                                                    SHA1

                                                                                                    71d30d2a03baffe302c380c11a9ffd3132d202b3

                                                                                                    SHA256

                                                                                                    3feef30561d1a19349a9448f77e1c31afa39a07ecb3a70a0afd0382a80d2a47c

                                                                                                    SHA512

                                                                                                    96b8ce3a67c812fa3680e4488d063c7476e7cf75b32c514b93105856ac04ef2a0495f27541f82e23318a5eee6ab9943761aae6def141e35244d36c2538fff034

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    96e4060cb9d3b6be7de793102722614b

                                                                                                    SHA1

                                                                                                    a3e4d8f5701bd3cfbe6831a2906964063b47d31d

                                                                                                    SHA256

                                                                                                    c920fbf7678bff78cec3319d9003fa50a61775157d8c1930729292e11060e745

                                                                                                    SHA512

                                                                                                    1d42bb025b05e73460c7e24bf642b8f35b2168382988b7be4a1c715d509101768a110110b5498d5ac38c80841e012d27b03a9a315c3a14a750b45c2957ec77c0

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    82c3b8f0c3c0d66e2ddfa4db6a0547ce

                                                                                                    SHA1

                                                                                                    700026c2172310766a30a76036590cfb9f28ffcf

                                                                                                    SHA256

                                                                                                    e333bdec4ef9958e371bb007f975b78b1f0700c8a1dbc41b445d372df3592256

                                                                                                    SHA512

                                                                                                    5169962bca0da43fc9386889120c3674ff17de0425e16768e94ff619ed445e366e9c632c1da180aa85a102d3d95b2dd993ab7ad29d4955fdb21a273ce189e0ec

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    d8917a7c9ac2968de444704f997dd97c

                                                                                                    SHA1

                                                                                                    ed4695cec857f948d18c981d13980195cd5765ac

                                                                                                    SHA256

                                                                                                    3cf9270a73298f9c6e623b940169fe382e2f70e4c5ba9e54e22359d395bd328a

                                                                                                    SHA512

                                                                                                    16bf17bc9051d6c4ea298e9641ff310282df86880065dd4b63b3039bc221f29c64e8074c3795a1f7e5cd1c030b49fd13cfb3d3144b0680898203355864cc100d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    57dd46ab4b6dcb07bdfb62810d8c8cc8

                                                                                                    SHA1

                                                                                                    05abd4d9fbc956b3e370736b643638fb143aeaa2

                                                                                                    SHA256

                                                                                                    56f6e5c4e7556daa90d83cdc6b7f8dd313a46198f5e93afc8799ae7943ad5d57

                                                                                                    SHA512

                                                                                                    7f80ea0710209b766c0ab5103580a98685b906b052f8bd316da492defc3f2ac7d9ebc4495e5aec9d2b2068dd18d35dbfbe64d20bb16c977b846755d763a2d706

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c459fc48-9ffa-4a8d-b588-e8029fd9aeb3.tmp

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    90f57def395c382ca77809cf2e459007

                                                                                                    SHA1

                                                                                                    5f9d5f834df38e2b14b5517c0d11edc8f9f5c386

                                                                                                    SHA256

                                                                                                    ea2522c11778eaf2478ac2a2b19d427acd9118678791107c0eb58062a685ef43

                                                                                                    SHA512

                                                                                                    7660a1a911a7347e1ac0d8317fe0860ba133ecd3b16a3b5e26f1ce5cc1ee569f18dcc065ba1c706130461fb0c0127ab680641ca625943b732a7a56543d7d1df3

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                    Filesize

                                                                                                    2.7MB

                                                                                                    MD5

                                                                                                    da044811ca4ac1cc04b14153dccbbf37

                                                                                                    SHA1

                                                                                                    6495d9b495010f8c79116e519a8784e342141b8a

                                                                                                    SHA256

                                                                                                    7c31979024f0d5873af50e66b541135b095a0958d7c0203e01f366cfb2a8d1b8

                                                                                                    SHA512

                                                                                                    0352129b629768f0192f58e43ac097758f3aae0236de363638ce14a994bdb0f17e31882f6ae7a93643222f542ffb21cf492d3c18dbaf6ec5822c45a8c2ce33d5

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tF7pU94.exe

                                                                                                    Filesize

                                                                                                    3.5MB

                                                                                                    MD5

                                                                                                    5590e27b29a7c772029204376b397608

                                                                                                    SHA1

                                                                                                    134eff4b17740eb48549698b534f48563c82717f

                                                                                                    SHA256

                                                                                                    fb42498ffa8268ba1b147635f39a30c17d0510381ed52f1fbaa8c50ed2978308

                                                                                                    SHA512

                                                                                                    ac8207c2dd2c5bd683bdbf47f423058e88aea2441793373aec70162e9fb23c8de88d5f54c2cd0ba2200edcfc0e9ec1fe23dbeba006fb5f01dd8dc62013caae02

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\uZ2Gp51.exe

                                                                                                    Filesize

                                                                                                    851KB

                                                                                                    MD5

                                                                                                    8d24e301759287ec970dbc4c0ed28390

                                                                                                    SHA1

                                                                                                    6aa68d2f49864e2cbaa754b7c31e3f3ef16cbefb

                                                                                                    SHA256

                                                                                                    fa11226d5ecefaa58429978cb70da8d6801af4ea74dfc5dd7d8c8fd1197ce0ff

                                                                                                    SHA512

                                                                                                    31b71259f5e4181cffd0076ec60e190afab77b328d8be8d7fe326e3e00d5b2d3e9c2e75781a9ef7ca3072edaea07f72b8c5254450b0675f1efb29e1621d2279b

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1jv31Nd0.exe

                                                                                                    Filesize

                                                                                                    895KB

                                                                                                    MD5

                                                                                                    4dd5c6e4867a3072fe9d3d333e0ebcd9

                                                                                                    SHA1

                                                                                                    a09dc5f4f5b2bc648f3d431dc7377b201099ec2e

                                                                                                    SHA256

                                                                                                    ce87bc4488d4b4ded9231b9f7fd76d4e39571caaa0ddb70215f70c6a134b7c67

                                                                                                    SHA512

                                                                                                    c11599be6dbf29e4988cf9a09966549126691503f3318ee8a7a421b6d0ebcdeb06c09eeb3d81274a337ddb82993d454f11aff6d224a323c28035fc0c37e8f485

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVSz8tpNDCIVXzK\TC5XK24l76OdWeb Data

                                                                                                    Filesize

                                                                                                    116KB

                                                                                                    MD5

                                                                                                    f70aa3fa04f0536280f872ad17973c3d

                                                                                                    SHA1

                                                                                                    50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                    SHA256

                                                                                                    8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                    SHA512

                                                                                                    30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tempAVSz8tpNDCIVXzK\tm0dSEWu1lteWeb Data

                                                                                                    Filesize

                                                                                                    92KB

                                                                                                    MD5

                                                                                                    ec564f686dd52169ab5b8535e03bb579

                                                                                                    SHA1

                                                                                                    08563d6c547475d11edae5fd437f76007889275a

                                                                                                    SHA256

                                                                                                    43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                    SHA512

                                                                                                    aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                  • \??\pipe\LOCAL\crashpad_2568_ADXMMSDVTLAWOHPT

                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                  • memory/3532-897-0x0000000003250000-0x0000000003266000-memory.dmp

                                                                                                    Filesize

                                                                                                    88KB

                                                                                                  • memory/4608-1789-0x0000000008D60000-0x0000000009378000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.1MB

                                                                                                  • memory/4608-1783-0x0000000000F10000-0x0000000000F4C000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB

                                                                                                  • memory/4608-2303-0x0000000008050000-0x000000000815A000-memory.dmp

                                                                                                    Filesize

                                                                                                    1.0MB

                                                                                                  • memory/4608-1786-0x0000000007E40000-0x0000000007E50000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/4608-2356-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB

                                                                                                  • memory/4608-1784-0x00000000748F0000-0x00000000750A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/4608-2357-0x0000000008000000-0x000000000804C000-memory.dmp

                                                                                                    Filesize

                                                                                                    304KB

                                                                                                  • memory/4608-2340-0x0000000007F60000-0x0000000007F72000-memory.dmp

                                                                                                    Filesize

                                                                                                    72KB

                                                                                                  • memory/5380-1785-0x0000000005A80000-0x0000000005B1C000-memory.dmp

                                                                                                    Filesize

                                                                                                    624KB

                                                                                                  • memory/5380-1782-0x00000000058E0000-0x0000000005972000-memory.dmp

                                                                                                    Filesize

                                                                                                    584KB

                                                                                                  • memory/5380-1781-0x0000000005DF0000-0x0000000006394000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.6MB

                                                                                                  • memory/5380-1788-0x0000000005870000-0x000000000587A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/5380-1749-0x00000000748F0000-0x00000000750A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/5380-1748-0x0000000000AD0000-0x0000000000F6E000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB

                                                                                                  • memory/5380-1787-0x0000000005B90000-0x0000000005BA0000-memory.dmp

                                                                                                    Filesize

                                                                                                    64KB

                                                                                                  • memory/5860-462-0x00000000076F0000-0x0000000007766000-memory.dmp

                                                                                                    Filesize

                                                                                                    472KB

                                                                                                  • memory/5860-405-0x00000000758B0000-0x00000000759A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5860-576-0x0000000008C30000-0x0000000008F84000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/5860-647-0x0000000005350000-0x00000000053B6000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/5860-403-0x00000000758B0000-0x00000000759A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5860-404-0x00000000758B0000-0x00000000759A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5860-810-0x0000000000D50000-0x000000000142A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/5860-413-0x0000000077404000-0x0000000077406000-memory.dmp

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                  • memory/5860-439-0x0000000000D50000-0x000000000142A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/5860-558-0x0000000008090000-0x00000000080AE000-memory.dmp

                                                                                                    Filesize

                                                                                                    120KB

                                                                                                  • memory/5860-806-0x00000000758B0000-0x00000000759A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5860-811-0x00000000758B0000-0x00000000759A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    960KB

                                                                                                  • memory/5860-805-0x0000000000D50000-0x000000000142A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/5860-394-0x0000000000D50000-0x000000000142A000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.9MB

                                                                                                  • memory/6968-898-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/6968-817-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/8128-295-0x0000000000B00000-0x0000000000C00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                  • memory/8128-296-0x0000000000A40000-0x0000000000ABC000-memory.dmp

                                                                                                    Filesize

                                                                                                    496KB

                                                                                                  • memory/8128-297-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB

                                                                                                  • memory/8128-377-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.6MB

                                                                                                  • memory/8128-378-0x0000000000A40000-0x0000000000ABC000-memory.dmp

                                                                                                    Filesize

                                                                                                    496KB