Analysis

  • max time kernel
    64s
  • max time network
    67s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-06-2024 13:56

General

  • Target

    https://www.mediafire.com/file/jrtqhg33ddfw1hy/main.exe/file#

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 34 IoCs
  • Detects Pyinstaller 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/jrtqhg33ddfw1hy/main.exe/file#
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc1413cb8,0x7ffbc1413cc8,0x7ffbc1413cd8
      2⤵
        PID:4484
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
        2⤵
          PID:2900
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2280
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
          2⤵
            PID:3512
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3068
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                2⤵
                  PID:2792
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
                  2⤵
                    PID:1860
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                    2⤵
                      PID:2080
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                      2⤵
                        PID:4752
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
                        2⤵
                          PID:3984
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                          2⤵
                            PID:4208
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
                            2⤵
                              PID:1840
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
                              2⤵
                                PID:3032
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                                2⤵
                                  PID:420
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
                                  2⤵
                                    PID:2076
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 /prefetch:8
                                    2⤵
                                      PID:900
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7180 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1136
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                                      2⤵
                                        PID:3396
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                                        2⤵
                                          PID:3592
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                                          2⤵
                                            PID:2752
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                                            2⤵
                                              PID:3808
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
                                              2⤵
                                                PID:4432
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                                                2⤵
                                                  PID:3712
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
                                                  2⤵
                                                    PID:3504
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
                                                    2⤵
                                                      PID:4928
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
                                                      2⤵
                                                        PID:3600
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
                                                        2⤵
                                                          PID:1264
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:1
                                                          2⤵
                                                            PID:5384
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:1
                                                            2⤵
                                                              PID:5512
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8940 /prefetch:1
                                                              2⤵
                                                                PID:5524
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9352 /prefetch:1
                                                                2⤵
                                                                  PID:5592
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9596 /prefetch:1
                                                                  2⤵
                                                                    PID:5660
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9516 /prefetch:1
                                                                    2⤵
                                                                      PID:5732
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9904 /prefetch:1
                                                                      2⤵
                                                                        PID:5804
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10140 /prefetch:8
                                                                        2⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5996
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
                                                                        2⤵
                                                                          PID:6140
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10328 /prefetch:1
                                                                          2⤵
                                                                            PID:5440
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10668 /prefetch:1
                                                                            2⤵
                                                                              PID:5900
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10632 /prefetch:1
                                                                              2⤵
                                                                                PID:5968
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10916 /prefetch:1
                                                                                2⤵
                                                                                  PID:6200
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10712 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6492
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9236 /prefetch:1
                                                                                    2⤵
                                                                                      PID:6500
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
                                                                                      2⤵
                                                                                        PID:6508
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
                                                                                        2⤵
                                                                                          PID:7088
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1688 /prefetch:1
                                                                                          2⤵
                                                                                            PID:6292
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6308
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10820 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5888
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5988
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,1939046365246664593,5936521491386348375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:8
                                                                                                  2⤵
                                                                                                  • NTFS ADS
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6224
                                                                                                • C:\Users\Admin\Downloads\main.exe
                                                                                                  "C:\Users\Admin\Downloads\main.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6200
                                                                                                  • C:\Users\Admin\Downloads\main.exe
                                                                                                    "C:\Users\Admin\Downloads\main.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:6044
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:4556
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:3424

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    6f738fcca0370135adb459fac0d129b9

                                                                                                    SHA1

                                                                                                    5af8b563ee883e0b27c1c312dc42245135f7d116

                                                                                                    SHA256

                                                                                                    1d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63

                                                                                                    SHA512

                                                                                                    8749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    68de3df9998ac29e64228cf1c32c9649

                                                                                                    SHA1

                                                                                                    be17a7ab177bef0f03c9d7bd2f25277d86e8fcee

                                                                                                    SHA256

                                                                                                    96825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43

                                                                                                    SHA512

                                                                                                    1658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                                                    Filesize

                                                                                                    62KB

                                                                                                    MD5

                                                                                                    42d9fcc7172456834d9e05605cfb999f

                                                                                                    SHA1

                                                                                                    d1df0982a953011482b7cc5e97803a5fae290ba7

                                                                                                    SHA256

                                                                                                    5029f1471e648ecdf5518199b5d7a6fdcf2dab7b9ba8367331b0836de3064575

                                                                                                    SHA512

                                                                                                    5fc471dfd6cf0516739b40db211b4f1e0d3e27e7b53eb1e0c8d34f7ddf5d09ff520bd4c3b7baca993857fd462f184621391fed363a548bc7b50eee3b7ef6ade8

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                                                    Filesize

                                                                                                    31KB

                                                                                                    MD5

                                                                                                    60140bc834da90837a9a4d1530484677

                                                                                                    SHA1

                                                                                                    d99868b0693b332681b4db7927f3f11b3ed37607

                                                                                                    SHA256

                                                                                                    29c0ba2fb11f5bbedff938e0d0a97da59f725cd153bc0c04f052419e779f134e

                                                                                                    SHA512

                                                                                                    448ddc49ab5128dfc0dc91ebe388d447e748848cd2f7dc15fe1fd0380a5436cc9872c32606d9d161d3648b20bff5eda0e48e8fb77c9293f3c0924ae89589eb37

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    a828f74a241290f8dc48320c692233dc

                                                                                                    SHA1

                                                                                                    facdb661f3d4757f2719c51bfda7591b6b10e904

                                                                                                    SHA256

                                                                                                    d98a58ab546052bd50f1a1dc19ed3985eef8889499192e5f602b87d0129627db

                                                                                                    SHA512

                                                                                                    3735b44770b3ed876f73a04b095e95a7e094a0c875b32f2b373c13d50aa22199ac836a5d6a02ed86bb3847e38276b7719da36b4ae405559bf4ff9d2a9e97ccfb

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    0355764bf8d92bb0d0b3927aaad1724b

                                                                                                    SHA1

                                                                                                    9eebf5fbe539b47b66c769e0f1e5c3a7e1558399

                                                                                                    SHA256

                                                                                                    1a2a09ddd473831e27dbfd5f5d8db0c4b1c3d0a29ab1f14a10bc72807d6a4d69

                                                                                                    SHA512

                                                                                                    9d79352a9e46ebc68433525d81e16698aca7152281bb9548972fa68c06201499f763fa0e59b0c0b9ea22677835034f76dcff14caaf2b6ddba95689e46076b2a7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    e6d1dafef27f294b8b6a9614fad6e8cd

                                                                                                    SHA1

                                                                                                    5b7830264b297ba87418a70da5317b933a2caa8a

                                                                                                    SHA256

                                                                                                    e0cadfc52ce62d8b1f4708c3a934367ccc591bb3b9a7addba46315f4683891b4

                                                                                                    SHA512

                                                                                                    7f363b2bbaac8c680ab3e610fc3c95582e04fb4c2caac46a22abc5ab85efb4fb34df0e88df64ef72a797a5debff6ce36b52f1c95f7535c5ab754e004a1fd9d25

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    e491021d31eb93d481950922151ecc47

                                                                                                    SHA1

                                                                                                    eed75c4f41e92be9c0d17e1cd1847bfc85a5953e

                                                                                                    SHA256

                                                                                                    153ac6b6a8e15e41b4cd57069ce3907746f8152642727bf5ae994d23aa65a658

                                                                                                    SHA512

                                                                                                    6fc26c8219b7536f603cd7013c9c36a2787262ebca3614cb858dd8a24cfc5408d9116bbbdb7c026cedab89d27df511e44504f89858cf64a87889f9e79ac1e568

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                    Filesize

                                                                                                    3KB

                                                                                                    MD5

                                                                                                    17e939a8966ea84780ab5577a23797b9

                                                                                                    SHA1

                                                                                                    604e3935bb3d25094d2300075f607d84ec87cee7

                                                                                                    SHA256

                                                                                                    23b08668a1dc6e90ab2d3ea23b8defdba70dd956b6e79f0a7074de760e7cb986

                                                                                                    SHA512

                                                                                                    e3faf5c75533d53fd5c708bf6ad0b501bb3031c60e38313598151f4cbad742fd3695d6978d8b12d0dad18753d265831315b948ae2d859a28c0ed571e154c3e96

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b95d.TMP

                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    281a27e5649effaf8c605f166ba08e0e

                                                                                                    SHA1

                                                                                                    cc5622d53d7e8e601ed01cd565c3bf54b6a7b9c8

                                                                                                    SHA256

                                                                                                    27bf448555e168df9bc9694d69f3d3ca76617d1c1766fa023b472c2385a4ce50

                                                                                                    SHA512

                                                                                                    82f10936c135bdc875329d91d9a02fe732949570267a72edae1a6e1d70d4ba5ad51742f01477fd8b8fe29a4277f5a1b069f8b1e0d5f5124d7e58a605cd490952

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    46295cac801e5d4857d09837238a6394

                                                                                                    SHA1

                                                                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                    SHA256

                                                                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                    SHA512

                                                                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    206702161f94c5cd39fadd03f4014d98

                                                                                                    SHA1

                                                                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                    SHA256

                                                                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                    SHA512

                                                                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    11KB

                                                                                                    MD5

                                                                                                    c077398109f10ed0b378b5d4917639b0

                                                                                                    SHA1

                                                                                                    7a3bd3466f5335af378541d8c8d6cafd9912d233

                                                                                                    SHA256

                                                                                                    275fbadcfebc925fe10cf9eca142e0b7471ec14fc25cf359ad7d6e2bc1d26acf

                                                                                                    SHA512

                                                                                                    5751e653b7d44b25b6ad25d62c7b31b296f27a28880aa07556621defbcd29aba8065bbd75c7adfbad2bdce5115b79b6ba762baa986ad1244d57acee5b784674e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    11KB

                                                                                                    MD5

                                                                                                    4057880d8aa0b5a74ba072b3411f1a2b

                                                                                                    SHA1

                                                                                                    7128f2aeb9b111d5ca096d71353c27bb6511f762

                                                                                                    SHA256

                                                                                                    3911f99a046b7bd038d8e890cde052a39e0636781aa5762ed90f18f1b00f6331

                                                                                                    SHA512

                                                                                                    e32bce55e0e185813bb2f11609b4580e3a2d06c10236526284f9ac5bcf70457be2df1785265c8f8a81f26d53b039351cc183e850e31e7391729acb36d069fe67

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\VCRUNTIME140.dll

                                                                                                    Filesize

                                                                                                    116KB

                                                                                                    MD5

                                                                                                    be8dbe2dc77ebe7f88f910c61aec691a

                                                                                                    SHA1

                                                                                                    a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                                    SHA256

                                                                                                    4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                                    SHA512

                                                                                                    0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\_ctypes.pyd

                                                                                                    Filesize

                                                                                                    122KB

                                                                                                    MD5

                                                                                                    bbd5533fc875a4a075097a7c6aba865e

                                                                                                    SHA1

                                                                                                    ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

                                                                                                    SHA256

                                                                                                    be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

                                                                                                    SHA512

                                                                                                    23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\base_library.zip

                                                                                                    Filesize

                                                                                                    1.3MB

                                                                                                    MD5

                                                                                                    08332a62eb782d03b959ba64013ac5bc

                                                                                                    SHA1

                                                                                                    b70b6ae91f1bded398ca3f62e883ae75e9966041

                                                                                                    SHA256

                                                                                                    8584f0eb44456a275e3bc69626e3acad595546fd78de21a946b2eb7d6ba02288

                                                                                                    SHA512

                                                                                                    a58e4a096d3ce738f6f93477c9a73ddbfcb4b82d212c0a19c0cf9e07f1e62b2f477a5dd468cd31cc5a13a73b93fa17f64d6b516afef2c56d38ede1ace35cf087

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\libffi-8.dll

                                                                                                    Filesize

                                                                                                    38KB

                                                                                                    MD5

                                                                                                    0f8e4992ca92baaf54cc0b43aaccce21

                                                                                                    SHA1

                                                                                                    c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                                                                                                    SHA256

                                                                                                    eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                                                                                                    SHA512

                                                                                                    6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\python3.DLL

                                                                                                    Filesize

                                                                                                    66KB

                                                                                                    MD5

                                                                                                    79b02450d6ca4852165036c8d4eaed1f

                                                                                                    SHA1

                                                                                                    ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

                                                                                                    SHA256

                                                                                                    d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

                                                                                                    SHA512

                                                                                                    47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI62002\python312.dll

                                                                                                    Filesize

                                                                                                    6.6MB

                                                                                                    MD5

                                                                                                    3c388ce47c0d9117d2a50b3fa5ac981d

                                                                                                    SHA1

                                                                                                    038484ff7460d03d1d36c23f0de4874cbaea2c48

                                                                                                    SHA256

                                                                                                    c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

                                                                                                    SHA512

                                                                                                    e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

                                                                                                  • C:\Users\Admin\Downloads\Unconfirmed 629789.crdownload

                                                                                                    Filesize

                                                                                                    35.8MB

                                                                                                    MD5

                                                                                                    a836df9260f719a93e95b095d383b0c2

                                                                                                    SHA1

                                                                                                    1dc2d87514b4934d7d9335682dbe2df5ffce0b02

                                                                                                    SHA256

                                                                                                    9d4ce917aed6ba6b447c60b8e14f6dc2a69fcb0650500318d8c44808190c09f9

                                                                                                    SHA512

                                                                                                    211b0fd97799c991e94673807e8b79218762a1c34a0c1ad4fde3f56a833c4b0fb6073193704e306e5082714fab2c3e3fbc795e7ec492c6f4de51a5523da58b0e

                                                                                                  • C:\Users\Admin\Downloads\main.exe:Zone.Identifier

                                                                                                    Filesize

                                                                                                    26B

                                                                                                    MD5

                                                                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                    SHA1

                                                                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                    SHA256

                                                                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                    SHA512

                                                                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                  • \??\pipe\LOCAL\crashpad_4008_PQSACKIYCVKUMVRL

                                                                                                    MD5

                                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                                    SHA1

                                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                    SHA256

                                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                    SHA512

                                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                  • memory/6044-526-0x00007FFBAD480000-0x00007FFBAD6E3000-memory.dmp

                                                                                                    Filesize

                                                                                                    2.4MB

                                                                                                  • memory/6044-527-0x00007FFBAC970000-0x00007FFBACE60000-memory.dmp

                                                                                                    Filesize

                                                                                                    4.9MB

                                                                                                  • memory/6044-528-0x00007FFBABD60000-0x00007FFBAC2A1000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.3MB

                                                                                                  • memory/6044-529-0x00007FFBABAF0000-0x00007FFBABD55000-memory.dmp

                                                                                                    Filesize

                                                                                                    2.4MB