Analysis

  • max time kernel
    64s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2023 08:56

General

  • Target

    078f9fcdf77fb93ae028eadb4d6c4e89.exe

  • Size

    1.7MB

  • MD5

    078f9fcdf77fb93ae028eadb4d6c4e89

  • SHA1

    8a24d85818ff9c9cc2b0863d228f9cb54e443742

  • SHA256

    bd68792e8bdc0c4f7733a20a823970ad42f7ed1e702ac5e72e2bdd9b80cab862

  • SHA512

    6a402bf23cc403be99fc3eaa307f117619dba042095604bd7a892482f1d5528e74ecb1bb269db2fa810f4adb9209df11f2efdc8e6e89d88a013d032cf0381f26

  • SSDEEP

    49152:KkXNjoHsHnCVyVZwoCui6fFhmvqyD3jnDCiCAKC:NdjoHVZ/uZhQqyD3jnm

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:17066

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe
    "C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1300
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7fff304646f8,0x7fff30464708,0x7fff30464718
              6⤵
                PID:2616
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3737235479296573945,3981470611112314318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:6428
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3737235479296573945,3981470611112314318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                6⤵
                  PID:6420
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3368
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                  6⤵
                    PID:2896
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1284240565236497497,13756430949709516551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5360
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1284240565236497497,13756430949709516551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                    6⤵
                      PID:5352
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4796
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                      6⤵
                        PID:4196
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5424759006395791493,3797389307101476766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5376
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5424759006395791493,3797389307101476766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
                        6⤵
                          PID:5368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2688
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x40,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                          6⤵
                            PID:3152
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5671432249481396826,5845272996665415246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5340
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5671432249481396826,5845272996665415246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                            6⤵
                              PID:5332
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                            5⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:3216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                              6⤵
                                PID:1432
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5508
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                                6⤵
                                  PID:6300
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
                                  6⤵
                                    PID:6292
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
                                    6⤵
                                      PID:5860
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                                      6⤵
                                        PID:5388
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
                                        6⤵
                                          PID:4056
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                                          6⤵
                                            PID:6820
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
                                            6⤵
                                              PID:7212
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
                                              6⤵
                                                PID:7292
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
                                                6⤵
                                                  PID:7476
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
                                                  6⤵
                                                    PID:7572
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                                                    6⤵
                                                      PID:7688
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                                                      6⤵
                                                        PID:7736
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
                                                        6⤵
                                                          PID:7824
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
                                                          6⤵
                                                            PID:8032
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                            6⤵
                                                              PID:8012
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
                                                              6⤵
                                                                PID:6940
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
                                                                6⤵
                                                                  PID:6916
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
                                                                  6⤵
                                                                    PID:6912
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
                                                                    6⤵
                                                                      PID:6844
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
                                                                      6⤵
                                                                        PID:2172
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
                                                                        6⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5568
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
                                                                        6⤵
                                                                          PID:1572
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1
                                                                          6⤵
                                                                            PID:2552
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8236 /prefetch:8
                                                                            6⤵
                                                                              PID:6284
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
                                                                              6⤵
                                                                                PID:6836
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:484
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                                                                                6⤵
                                                                                  PID:4904
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4444876494008914290,12518360206431109331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5832
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4444876494008914290,12518360206431109331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
                                                                                  6⤵
                                                                                    PID:5820
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2056
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                                                                                    6⤵
                                                                                      PID:4036
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14498505262747003310,18150790098072885200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5916
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14498505262747003310,18150790098072885200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5908
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4628
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                                                                                        6⤵
                                                                                          PID:1500
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6925780463672762664,12424803477326082596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:6924
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                        5⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3740
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x78,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                                                                                          6⤵
                                                                                            PID:3500
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                          5⤵
                                                                                            PID:6268
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718
                                                                                              6⤵
                                                                                                PID:6360
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe
                                                                                            4⤵
                                                                                            • Modifies Windows Defender Real-time Protection settings
                                                                                            • Executes dropped EXE
                                                                                            • Windows security modification
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:6812
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Checks SCSI registry key(s)
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          PID:7484
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe
                                                                                        2⤵
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Adds Run key to start application
                                                                                        • Drops file in System32 directory
                                                                                        • Checks processor information in registry
                                                                                        • outlook_office_path
                                                                                        • outlook_win_path
                                                                                        PID:2492
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                          3⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:5572
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                          3⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:6308
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1776
                                                                                          3⤵
                                                                                          • Program crash
                                                                                          PID:5660
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1692
                                                                                          3⤵
                                                                                          • Program crash
                                                                                          PID:7436
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:6676
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:6936
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                          1⤵
                                                                                            PID:7944
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                            1⤵
                                                                                              PID:7556
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2492 -ip 2492
                                                                                              1⤵
                                                                                                PID:6932
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2492 -ip 2492
                                                                                                1⤵
                                                                                                  PID:1968
                                                                                                • C:\Users\Admin\AppData\Local\Temp\1EFD.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\1EFD.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6324
                                                                                                • C:\Users\Admin\AppData\Local\Temp\51D5.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\51D5.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6668
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
                                                                                                    2⤵
                                                                                                      PID:6912
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\Broom.exe
                                                                                                        3⤵
                                                                                                          PID:6312
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
                                                                                                        2⤵
                                                                                                          PID:6232
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                                                                                                          2⤵
                                                                                                            PID:4444
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\tuc3.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                            2⤵
                                                                                                              PID:5168
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-DK5QQ.tmp\tuc3.tmp
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-DK5QQ.tmp\tuc3.tmp" /SL5="$8021E,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
                                                                                                                3⤵
                                                                                                                  PID:5140
                                                                                                                  • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                    "C:\Program Files (x86)\xrecode3\xrecode3.exe" -i
                                                                                                                    4⤵
                                                                                                                      PID:1724
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      "C:\Windows\system32\schtasks.exe" /Query
                                                                                                                      4⤵
                                                                                                                        PID:6908
                                                                                                                      • C:\Program Files (x86)\xrecode3\xrecode3.exe
                                                                                                                        "C:\Program Files (x86)\xrecode3\xrecode3.exe" -s
                                                                                                                        4⤵
                                                                                                                          PID:5672
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          "C:\Windows\system32\net.exe" helpmsg 1
                                                                                                                          4⤵
                                                                                                                            PID:5148
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 helpmsg 1
                                                                                                                              5⤵
                                                                                                                                PID:3608
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                                                                                                                          2⤵
                                                                                                                            PID:1452
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6E86.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\6E86.exe
                                                                                                                          1⤵
                                                                                                                            PID:7412
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\73D6.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\73D6.exe
                                                                                                                            1⤵
                                                                                                                              PID:5824

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\323dc16f-a91f-4a41-be43-35154f2bed74.tmp

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              f27cd1f89d1a43af3065e4bae1dec46e

                                                                                                                              SHA1

                                                                                                                              9c49c774db5629b167035ab5679315c135ff4d6a

                                                                                                                              SHA256

                                                                                                                              3e9aa3164494e24a73ef8742a6ac33dcca9c96a954b91de241ea5109943ca0e8

                                                                                                                              SHA512

                                                                                                                              4bcfb9c0c7064fc8569cb2a33976a458154597b2dffe299306f4f4f8f585da872aee090fdda19ab0495c7b4ca8bedc95c65d55f743c045cbe2d8692ad0d0a8ae

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                              Filesize

                                                                                                                              152B

                                                                                                                              MD5

                                                                                                                              edf2b2514bd574ccef3a3da9d0be4d9d

                                                                                                                              SHA1

                                                                                                                              78c247610ff063087c9571c1446778eb32993893

                                                                                                                              SHA256

                                                                                                                              13d82ea9734f67a5fff85da945a9e7b49380d2f3917b11e170cea864cef2d5e2

                                                                                                                              SHA512

                                                                                                                              5090983fdbe645c7db074e142d01bedd03d1b30ca13ae8dc7a2417f871da5173d1d2ae0f4c084ce423e1c57deed1d27fad77a06fd904d8f2ff7fef797afd2210

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                              Filesize

                                                                                                                              152B

                                                                                                                              MD5

                                                                                                                              7c89e9212e22e92acc3d335fe9a44fe6

                                                                                                                              SHA1

                                                                                                                              c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f

                                                                                                                              SHA256

                                                                                                                              18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44

                                                                                                                              SHA512

                                                                                                                              c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                                                                                              Filesize

                                                                                                                              20KB

                                                                                                                              MD5

                                                                                                                              923a543cc619ea568f91b723d9fb1ef0

                                                                                                                              SHA1

                                                                                                                              6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                                              SHA256

                                                                                                                              bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                                              SHA512

                                                                                                                              a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

                                                                                                                              Filesize

                                                                                                                              21KB

                                                                                                                              MD5

                                                                                                                              7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                                              SHA1

                                                                                                                              68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                                              SHA256

                                                                                                                              6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                                              SHA512

                                                                                                                              cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

                                                                                                                              Filesize

                                                                                                                              33KB

                                                                                                                              MD5

                                                                                                                              909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                                              SHA1

                                                                                                                              feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                                              SHA256

                                                                                                                              dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                                              SHA512

                                                                                                                              b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

                                                                                                                              Filesize

                                                                                                                              190KB

                                                                                                                              MD5

                                                                                                                              d55250dc737ef207ba326220fff903d1

                                                                                                                              SHA1

                                                                                                                              cbdc4af13a2ca8219d5c0b13d2c091a4234347c6

                                                                                                                              SHA256

                                                                                                                              d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd

                                                                                                                              SHA512

                                                                                                                              13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

                                                                                                                              Filesize

                                                                                                                              200KB

                                                                                                                              MD5

                                                                                                                              b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                                              SHA1

                                                                                                                              19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                                              SHA256

                                                                                                                              8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                                              SHA512

                                                                                                                              86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                              Filesize

                                                                                                                              5KB

                                                                                                                              MD5

                                                                                                                              2a338df9bcf25a99c74ee9ba33df2a43

                                                                                                                              SHA1

                                                                                                                              c74af6958d0e56c03159d230b646d6619f5552b6

                                                                                                                              SHA256

                                                                                                                              96c5dca031d10e7b31b432244c860c54e80d489428b68d0b07177d12692681bd

                                                                                                                              SHA512

                                                                                                                              7197593b570783b1d5f944fe66c515ef0a27e8ebcab48f9c8b03eb54391491b0492cf0a443449caec86964198618e8c5b6eb6c9f4851f6c222953a7fdc2914d5

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                              Filesize

                                                                                                                              111B

                                                                                                                              MD5

                                                                                                                              285252a2f6327d41eab203dc2f402c67

                                                                                                                              SHA1

                                                                                                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                              SHA256

                                                                                                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                              SHA512

                                                                                                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              MD5

                                                                                                                              cf7d51d83705db8cd0518a209f0672ce

                                                                                                                              SHA1

                                                                                                                              42770583f9b4999e22598d03fb3d2f71b0ef2493

                                                                                                                              SHA256

                                                                                                                              d1fc16a9559c6979d16570ee763ae4f44e90169dd7a4cf04af81200213204438

                                                                                                                              SHA512

                                                                                                                              337cec4ce44325b0e824d60a3b5a7828605b69c7db27d82ee6c2ad503ddae5f7ce9fdadb1fd41386b5de432af9275dde063daf7ead51632a19b91958fc38e935

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              MD5

                                                                                                                              9c9f55b02db17e54b4b523c561d82d77

                                                                                                                              SHA1

                                                                                                                              33c70435f5c8dd583e76c1b997c234f33016990f

                                                                                                                              SHA256

                                                                                                                              1a95f1e3069d85f4317597a576243d61c7f91bad92bd12ed8925759bb1d6233a

                                                                                                                              SHA512

                                                                                                                              08dc9095552daafe2d612727c49143e55529975187af310a59be4ab3cc8a6bc48d5477dedba96d622a098e2d9a02aefdb3162893b8778f29238047190aff8f8b

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                              Filesize

                                                                                                                              5KB

                                                                                                                              MD5

                                                                                                                              d276fddebeac59c602fb3871d016a7b5

                                                                                                                              SHA1

                                                                                                                              e7cbafa7b80adff9acf34221205be33c752ac786

                                                                                                                              SHA256

                                                                                                                              9a758017f4740a88ea5752e55fb25b998b2d2393d7b804f8fe3614014fd775a5

                                                                                                                              SHA512

                                                                                                                              307c0978a01c37443602fc719e5abc51c9fe2895d31366f6255c4228b9d3ac3da6588c9804c6219b5e615ff0e2ecea58469ed943f0fccc57562f5924439459d5

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              MD5

                                                                                                                              5f7857fdb22315bc5b77383b1d4b8aa8

                                                                                                                              SHA1

                                                                                                                              a799afcf5a40dcc4478261250d7da56f8df02e58

                                                                                                                              SHA256

                                                                                                                              bb0cbc0d2e8733089d47766a8eca0aa58e3756ef3db8ae8cc94dc616872cdd24

                                                                                                                              SHA512

                                                                                                                              fb0b113c8b136bd9288842295a78a8d3bf108fb2aa4936ffb08607a21f418d1fa0c7a82d370edfbb9a2791c5b73abbfc7c4affa3bda86811f54b71d0a2d89440

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                              Filesize

                                                                                                                              24KB

                                                                                                                              MD5

                                                                                                                              d7b2b29ef1d9a33e61e1167984c8ca3e

                                                                                                                              SHA1

                                                                                                                              9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34

                                                                                                                              SHA256

                                                                                                                              7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2

                                                                                                                              SHA512

                                                                                                                              3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                              Filesize

                                                                                                                              89B

                                                                                                                              MD5

                                                                                                                              a28dec0a790391491c356e0ec5fc3c98

                                                                                                                              SHA1

                                                                                                                              3806d149f93671726c7dde60c066a080a9301e63

                                                                                                                              SHA256

                                                                                                                              481049fbbe97d08991740866f3dc5030919f7595351630f241c7314c7a2804e0

                                                                                                                              SHA512

                                                                                                                              138e8bdb2e908328235b68b1ebed34453a1072994044103de080d68b36f23fa3f60fb1083233c569bf4a824f7bdbac427e0e200747de5528359613bd19411a62

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                              Filesize

                                                                                                                              146B

                                                                                                                              MD5

                                                                                                                              c6ff273753694a3dcd35b1a3462f3115

                                                                                                                              SHA1

                                                                                                                              93611e945dd582da19931cda1972fabb78a6e29b

                                                                                                                              SHA256

                                                                                                                              843398a63d999e6735aef0e599431d531895f354324dae656fbe4e7e95b1f4e5

                                                                                                                              SHA512

                                                                                                                              6c912e150d23d8a46f467f5daf4bf58f53c6284fdd6c1b2f75811adedb0583c7a782477a5d190f2606ee5e4203c3c0d5571d61a46b3ead26aefb8e06345ceafb

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                                              Filesize

                                                                                                                              82B

                                                                                                                              MD5

                                                                                                                              496d50969485119261d4573052fed274

                                                                                                                              SHA1

                                                                                                                              9b040842fad493f31bf0ee7836337c3eb93fc295

                                                                                                                              SHA256

                                                                                                                              69f0af33206a7bd86bb38400d437d2447832560450dc2ae41690f7dd32c0ad07

                                                                                                                              SHA512

                                                                                                                              da6dc4ec4f5d9fa3a357dd0ddbc9877cb4b50df50ad8ff3187a7dd9bff5625def0f811eae488bd594bc5b4f94511d70a6d5012f890bcf267d2ca1817fe1d86f9

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                                              Filesize

                                                                                                                              83B

                                                                                                                              MD5

                                                                                                                              6734c77254d0f954ea25bfbcb4837b3f

                                                                                                                              SHA1

                                                                                                                              553d3ccde9f2b694d684d090dcae2f68ae94eb0c

                                                                                                                              SHA256

                                                                                                                              62d24bd109a65132c4197fd708dc3dee0b102df2940990124b482b2c8aa0b785

                                                                                                                              SHA512

                                                                                                                              46be7c3c548fd07264628c9e15969d285b6e08fb291b1932946736fa5dff3ea374e44632f89f150bc7b8e8b192ea57b5d14698601ee4d0a107fb2354df62afc9

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                                              Filesize

                                                                                                                              16B

                                                                                                                              MD5

                                                                                                                              46295cac801e5d4857d09837238a6394

                                                                                                                              SHA1

                                                                                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                              SHA256

                                                                                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                              SHA512

                                                                                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                              Filesize

                                                                                                                              96B

                                                                                                                              MD5

                                                                                                                              a715d27376282d7083b1294a45b5116c

                                                                                                                              SHA1

                                                                                                                              73a90baacc36bb8c66eb2e2df7e32867ac26133a

                                                                                                                              SHA256

                                                                                                                              68505c145568cbcbd71fb35e050e1912040b8f0f96327becb85e193561434a6b

                                                                                                                              SHA512

                                                                                                                              6f2e45d751a0716e7ef7999fb5980b9cc0f2d4e5ca414452e5441412c5c88a8bb019b85c751b2a34672b3020c65ffb58a3261a5139c45fd7fb8614cb06937507

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585752.TMP

                                                                                                                              Filesize

                                                                                                                              48B

                                                                                                                              MD5

                                                                                                                              2fce78e43589fadb47dcc1fc44383c0a

                                                                                                                              SHA1

                                                                                                                              e4b96f0a04443b5f27ef7902581cc60da53e146c

                                                                                                                              SHA256

                                                                                                                              a540f0712190b1794dd42d5b19784b2b727c55d711c1ae6d201f800aebe4893c

                                                                                                                              SHA512

                                                                                                                              0d5f8ede9b11fddab2c2b8e0867877da8122a0865ccf76b5baff223dfe3e09fc539c4cb36873a645fd5ee5537ec5e40ae20765c3a1a9f748342a5397ee92ec88

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              MD5

                                                                                                                              27ba5f751517ce60fd90827cfb4b96e8

                                                                                                                              SHA1

                                                                                                                              f86071dc0bed05e8827cc8ef2d0a58748b706f2b

                                                                                                                              SHA256

                                                                                                                              172c3c93bd668716c6b3756f802780297252270338b6b372ea624d93f17592dc

                                                                                                                              SHA512

                                                                                                                              ac5349e873778393648476edbff886c17d40c40291422b141d8743d1c21e2eae447a410eb564c4c210d2053363eb2f678eb28a5033b59b6f67580bf0b9739f60

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              MD5

                                                                                                                              19da989f281d58cc7a188984515a04f8

                                                                                                                              SHA1

                                                                                                                              774f707cd813c4e172286bb0197ae5f642da490e

                                                                                                                              SHA256

                                                                                                                              d3d932f37283cce0c1dc0788911b0a821a45c3160e529ca19bf2e3073b2fb7e1

                                                                                                                              SHA512

                                                                                                                              10256562b19d4aa3a81dc9da99c271d2d7506f1c560b73554e0b1cb02c4113e2caab444b2c6ad8e45ec672943be236393748c220bf7ca001f6b0bee3b81779c7

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                              Filesize

                                                                                                                              3KB

                                                                                                                              MD5

                                                                                                                              7ce86ad3d292e6ace9cf13d73d8609f8

                                                                                                                              SHA1

                                                                                                                              ca6f12f61a377dfb99bcb59922c39a39ef376e5d

                                                                                                                              SHA256

                                                                                                                              641341a92f752cf6e630431947ee5cc7cfa63a77c4a29deadd7f48b50ce94e89

                                                                                                                              SHA512

                                                                                                                              bd5975e72c6e1c99bd131c5c4034e2defec8540df6de6870067e7a254fe0b53ce9c4f5b7ad66cfaeb43776c67342e96023351a6ea34780454848fb5178c28d43

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4a1.TMP

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              22eeb91f3b9e9203a2ccb8eb104c521b

                                                                                                                              SHA1

                                                                                                                              93593040f5dfae6d5a00b9b4cf547b36b198b4a4

                                                                                                                              SHA256

                                                                                                                              e1ddbdef6a1efb2e62b321d1d411d694528982a49439990d0914c2297864f77a

                                                                                                                              SHA512

                                                                                                                              680b018a743764a3b01e27b4aee682c71b3bdc8d909f840d7400e96aa41d689c024f1af9df318d15119caf8bcdabd3850daef276977999d91f66c974dcc3f7dc

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                              Filesize

                                                                                                                              16B

                                                                                                                              MD5

                                                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                                                              SHA1

                                                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                              SHA256

                                                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                              SHA512

                                                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              7c94b94bfcfe630bc7f5e44d5a10f5ab

                                                                                                                              SHA1

                                                                                                                              48959704a5cc735a0b8edfda935c7a425fe4ff8c

                                                                                                                              SHA256

                                                                                                                              3678c940f2c51e0e54693e6523f44cb28f0b94543ce902c76f8e4b8001e660cf

                                                                                                                              SHA512

                                                                                                                              747bf86e36d85098237f0952cb8a352208c0c9d07daaf032aba32039fd5849f1047d8c77a1c0bee19ceb5414e0a3cb9ccfddce1f6d25fe942c25112ae531b9fb

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              32c587272cc8e26b1cec7da0beb23b38

                                                                                                                              SHA1

                                                                                                                              6656b20a010c8cf626962340fa749b1796a13960

                                                                                                                              SHA256

                                                                                                                              b620d900d20e6ca6725fe7688f4ea80503402eb8b3537bb81b87c14e679e35cc

                                                                                                                              SHA512

                                                                                                                              6631ba38554ff7db96a7bf13bfd7c22c5b5eb74054b740a2eefd96d86d06ccf18cd69235537d53bb38af5af3fcbf0c027ab13356abab3df6c0236d3a4d9b9588

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              fd668826a6f5f8b48b80dfbfeb9be2c8

                                                                                                                              SHA1

                                                                                                                              a80d01ef1749de1ecda5dde581185919fd46469f

                                                                                                                              SHA256

                                                                                                                              f464d0524728a8152b944e23efb914fd99f9d463c18098337de900f8bc356e65

                                                                                                                              SHA512

                                                                                                                              a2060fc811709c138ea40bc261a3f61fa4794da179f988d7b53890e3875d7a95f4f30e773634c81f7ff7e4b78dd9490b945cf3143ee3e0d5db6989bfcf9c6bb2

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              604a7658afb3aa59cf8ab9bbc100ac20

                                                                                                                              SHA1

                                                                                                                              deeefe12ca0e3e5370694b38f2d7fb5ce23db5ca

                                                                                                                              SHA256

                                                                                                                              af7237382c51ee852f6f8c6948297dacce1a3ddde3f305d76610b334d535f715

                                                                                                                              SHA512

                                                                                                                              c755680e4fae6d5f840ef8e950eb614bff98ef71f436deaab73a880696560b7aa4350970a2f6a004850cf0d05c581566cc4e2a56cd72ebf7e11933cffe13ede0

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              2396a1e5d6a5c3b3f366af506a22980b

                                                                                                                              SHA1

                                                                                                                              d4508099adc1896d2933cce57ee049acb87bdb0a

                                                                                                                              SHA256

                                                                                                                              3e365fedad30a9fa87ca5553ea8d0772c0bb2b82a8561951c7bd794f39f8c0d1

                                                                                                                              SHA512

                                                                                                                              fc93cbd35622b571d40c0d3f113b80df90cd1284e799f9abc78e21e867644f0e02cd5d986483e1c97f206ea5b866c231a1ff018c44683c6daf6755835c87d0ed

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              10KB

                                                                                                                              MD5

                                                                                                                              6780670d248a0102be06c2a9f37a85a6

                                                                                                                              SHA1

                                                                                                                              29710304a0e57fbc240fb729b211c88ef32e59b3

                                                                                                                              SHA256

                                                                                                                              d6713245801538e6257598ed2f8dc108db2bb885a9eff1f445f807c8df244205

                                                                                                                              SHA512

                                                                                                                              a69ca480e3117c6d98b23cfe993e48e42f27dcc2a0c30dc2d82b6f12365fa4b4b70f0398379b4a831d826230b0f538bff2fc83905b645c4e5faff96aab027120

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              18b3744b59252204b9d226e5b945cf3a

                                                                                                                              SHA1

                                                                                                                              300db58ec4259a889b316012ed063facdcf033d7

                                                                                                                              SHA256

                                                                                                                              860fecb3ef41986ac0da1fc4e2010201638ed6e4a01f81cb7d26a328aeba137f

                                                                                                                              SHA512

                                                                                                                              a9d396c158ddae6129a7124727a7f6aaf42e49d631a4f10b89d59340056240a9d176c56e6d581928ed2c1628bf0655c2e12df3f4daabaae9f51cff8ed5cf06b0

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

                                                                                                                              Filesize

                                                                                                                              751KB

                                                                                                                              MD5

                                                                                                                              aa1cc24853b99a35c5638bc216892ae0

                                                                                                                              SHA1

                                                                                                                              74486d4999186ec36952149c8933958afafb6d2a

                                                                                                                              SHA256

                                                                                                                              f4b274c223e10a695fcc0fd06610c613ae4c7c5173d6b64065de0605147ef9d8

                                                                                                                              SHA512

                                                                                                                              76022d3c67cf7c01e6e5039119bc5a01439a888b73b6b0691ede925a1529f03b433bd72c8d787e5f224f1017bb8fb7eb3f47959145ad2aadd1eee7c652303c5f

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                                              Filesize

                                                                                                                              985KB

                                                                                                                              MD5

                                                                                                                              28f0456d7a96687fe5e7c6546ae3c1d6

                                                                                                                              SHA1

                                                                                                                              b7dd157bc403a3943b7c8727bbfe22bde1d1ac8d

                                                                                                                              SHA256

                                                                                                                              ca963a25bb55341c8b97b05d9fc28afacaa3b55a2b7f0eae5a70e000cc3b15ff

                                                                                                                              SHA512

                                                                                                                              344cbc2e278be0609e07a0bcbdfbc0e637c792cc15856a9b5f5ee8bcdfadb8751fea018723fedfbff22e9a5f763f249f3cd43ae31c27fd1ffbedbc2fdffc02a6

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

                                                                                                                              Filesize

                                                                                                                              758KB

                                                                                                                              MD5

                                                                                                                              4c2d7fa0225cbbc6024d57d73ddd2fad

                                                                                                                              SHA1

                                                                                                                              f4567eaab7ae2c5f06c51adcca873ea711add9ad

                                                                                                                              SHA256

                                                                                                                              bfc27e4b20682d136fb8e67a68342858e67a68677db57d93c557217787e37f47

                                                                                                                              SHA512

                                                                                                                              c8e0fdf65a712361a2019c2b2bf3b4efdfb79ce27fe556106714b807b7d11b86618c0fa5fe2b829a5c350d586b6e715a4b2ec8922c08b7b0ee414831c107c8bb

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

                                                                                                                              Filesize

                                                                                                                              635KB

                                                                                                                              MD5

                                                                                                                              af9bc78632dd29cfc03cb7ea28ca109c

                                                                                                                              SHA1

                                                                                                                              10ab4aa11bce02bdd89a0b83b2dfd664c822e845

                                                                                                                              SHA256

                                                                                                                              09ca8d8dc937c214acfa446856d2d581ebfe3eafd714b1ed8476eafbb584bfc0

                                                                                                                              SHA512

                                                                                                                              4f0dda6b2cb63b7ac9fac0c7bbe0b00c9b7ff71264b817046b5e6b3479850a75fa6bb9d37cd382b9eda379b4f4c80aa26fb6fcb92985407be04cb20942ff641f

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

                                                                                                                              Filesize

                                                                                                                              898KB

                                                                                                                              MD5

                                                                                                                              b3aa90e6a654d56d25035d0a5a28cc6f

                                                                                                                              SHA1

                                                                                                                              66843c6e6fce2223d0f6df40b51b9f3becbc2404

                                                                                                                              SHA256

                                                                                                                              9b75653079a704051bf7b56374aa6c23eecbed90dbdaadc6c12eebfca61eb35c

                                                                                                                              SHA512

                                                                                                                              b94947f0c442373764b6fd4c655aa23e57096ed2f7abc429aeb3f421b01d7816daa884adf622b92d4daf804d22d7c58bd23c18d08412b8c9ae93cdb7128cbfb8

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

                                                                                                                              Filesize

                                                                                                                              182KB

                                                                                                                              MD5

                                                                                                                              e7e277a6147133c7cecd80af49083900

                                                                                                                              SHA1

                                                                                                                              01c9a5b63416c13a2c11c0f010640196f35befe3

                                                                                                                              SHA256

                                                                                                                              8e0d58c7315f6f970ac3be9fc4373a1da3373a017edab993425f0e18a506de17

                                                                                                                              SHA512

                                                                                                                              1b88bd2d794a443d47292f897474d9dc8026d2a669524736b51c80e03cac849254a79401a42673ab8a7587b8dbd4bc2133b714de46048aa18e8a85828937d482

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

                                                                                                                              Filesize

                                                                                                                              1.6MB

                                                                                                                              MD5

                                                                                                                              5b11fdb9db6d3b0ab01d29311eb1beda

                                                                                                                              SHA1

                                                                                                                              08e8837d100555812ee973d78b076159498ce1c1

                                                                                                                              SHA256

                                                                                                                              4ff6c26620c8b4951a0bdfe7588174a2b2f1b43fe2d4da274d0f407a97f570fd

                                                                                                                              SHA512

                                                                                                                              86811da37f70e9d5260094108f4130f949fa15b1ead226ff5e7994325bbecdeda2c479ae2dc56f1612222566109761e33e11bb6b9110e9e36128daa1eb00cf86

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\grandUIASpysa9JBccEoT\information.txt

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              MD5

                                                                                                                              b7977b3761088692b8e293ef5cdd7dd5

                                                                                                                              SHA1

                                                                                                                              09e379b596942d4a2e9c92fc52f7f95d6fb3068c

                                                                                                                              SHA256

                                                                                                                              395206d64f24594613e42fdaec46e6fa08a351e3de5b429092ca42f53215a6e4

                                                                                                                              SHA512

                                                                                                                              b6bc6fa6b822e22cf64d70280f4d96910a17aabf923c4d98e56cd7ee9b1c2463e36e6165c2d1a0851015f434bbe17997eca83834c0500cd6ce11f7ff96cef54a

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                                                              Filesize

                                                                                                                              832KB

                                                                                                                              MD5

                                                                                                                              99a4172e07fb4619e4e2960607f082f2

                                                                                                                              SHA1

                                                                                                                              0f827a54a776bc65c319f165ab8568db550f2897

                                                                                                                              SHA256

                                                                                                                              5c5d53c2d27b987dd03014bd1627b6af11248612dfe101e6f84cd450a03658cd

                                                                                                                              SHA512

                                                                                                                              01121b0cdad5a9c8b7acd8e77c236104441cc242699e4aa38f6f5cec9832a297c3a45f4955f36b150687c7046110bbd42f9dd4b366790d17f88adbe482e5ccbd

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                                                              Filesize

                                                                                                                              291KB

                                                                                                                              MD5

                                                                                                                              cde750f39f58f1ec80ef41ce2f4f1db9

                                                                                                                              SHA1

                                                                                                                              942ea40349b0e5af7583fd34f4d913398a9c3b96

                                                                                                                              SHA256

                                                                                                                              0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094

                                                                                                                              SHA512

                                                                                                                              c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tuc3.exe

                                                                                                                              Filesize

                                                                                                                              1.6MB

                                                                                                                              MD5

                                                                                                                              94649f283776ce0bc4d9480e32582a50

                                                                                                                              SHA1

                                                                                                                              52c15c4f177269217727342d2f318a3d78b449e9

                                                                                                                              SHA256

                                                                                                                              198cf5578b0dc9150e020727d05d910dd8241941bd7ffe54fa494f799860ce8a

                                                                                                                              SHA512

                                                                                                                              b342818b22ab480acb80738b0dc2bd7cb2e67fe57c00009f949ba04410c9ce692d6428b391725a3e88fe59cfff7da211c23075ed5c6052c66e5c2768725a5f67

                                                                                                                            • memory/1724-1370-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              3.5MB

                                                                                                                            • memory/1724-1367-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              3.5MB

                                                                                                                            • memory/2492-843-0x0000000000400000-0x0000000000919000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.1MB

                                                                                                                            • memory/2492-652-0x0000000000400000-0x0000000000919000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.1MB

                                                                                                                            • memory/2492-649-0x0000000002770000-0x0000000002905000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.6MB

                                                                                                                            • memory/2492-648-0x0000000002690000-0x0000000002766000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              856KB

                                                                                                                            • memory/2492-879-0x0000000002770000-0x0000000002905000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.6MB

                                                                                                                            • memory/3280-631-0x0000000000BB0000-0x0000000000BC6000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              88KB

                                                                                                                            • memory/5140-1239-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                            • memory/5168-1215-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              80KB

                                                                                                                            • memory/5672-1375-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              3.5MB

                                                                                                                            • memory/5672-1383-0x0000000000400000-0x0000000000785000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              3.5MB

                                                                                                                            • memory/5824-1422-0x00000000002A0000-0x00000000002DC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                            • memory/5824-1421-0x00000000747C0000-0x0000000074F70000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6312-1213-0x0000000002730000-0x0000000002731000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                            • memory/6312-1414-0x0000000002730000-0x0000000002731000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                            • memory/6324-1386-0x0000000007CB0000-0x0000000007D42000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              584KB

                                                                                                                            • memory/6324-1420-0x000000000AA40000-0x000000000AA7C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                            • memory/6324-1412-0x0000000009060000-0x0000000009678000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              6.1MB

                                                                                                                            • memory/6324-1424-0x000000000ABC0000-0x000000000AC0C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              304KB

                                                                                                                            • memory/6324-1415-0x000000000A9E0000-0x000000000A9F2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                            • memory/6324-1369-0x0000000002BB0000-0x0000000002BEC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                            • memory/6324-1388-0x0000000007C70000-0x0000000007C7A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              40KB

                                                                                                                            • memory/6324-1413-0x000000000AAB0000-0x000000000ABBA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.0MB

                                                                                                                            • memory/6324-1387-0x0000000007EF0000-0x0000000007F00000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/6324-1384-0x00000000747C0000-0x0000000074F70000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6668-1226-0x0000000074DE0000-0x0000000075590000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6668-1166-0x0000000074DE0000-0x0000000075590000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6668-1167-0x0000000000FD0000-0x0000000002486000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              20.7MB

                                                                                                                            • memory/6812-503-0x0000000074580000-0x0000000074D30000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6812-197-0x00000000048D0000-0x00000000048EC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              112KB

                                                                                                                            • memory/6812-198-0x0000000074580000-0x0000000074D30000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/6812-199-0x0000000004900000-0x0000000004910000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/6812-201-0x0000000004900000-0x0000000004910000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/6812-200-0x0000000004950000-0x0000000004EF4000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.6MB

                                                                                                                            • memory/6812-202-0x0000000004F50000-0x0000000004F6A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              104KB

                                                                                                                            • memory/7412-1400-0x00000000747C0000-0x0000000074F70000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                            • memory/7412-1401-0x0000000000340000-0x0000000000834000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.0MB

                                                                                                                            • memory/7412-1411-0x0000000005350000-0x00000000053EC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              624KB

                                                                                                                            • memory/7412-1417-0x0000000004FF0000-0x0000000005000000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/7484-508-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              44KB

                                                                                                                            • memory/7484-633-0x0000000000400000-0x000000000040B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              44KB