Malware Analysis Report

2025-01-02 03:51

Sample ID 231212-kv1m3sbeh8
Target 078f9fcdf77fb93ae028eadb4d6c4e89.exe
SHA256 bd68792e8bdc0c4f7733a20a823970ad42f7ed1e702ac5e72e2bdd9b80cab862
Tags
privateloader risepro smokeloader backdoor evasion loader persistence stealer trojan redline @oleh_ps livetraffic paypal collection discovery infostealer phishing spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd68792e8bdc0c4f7733a20a823970ad42f7ed1e702ac5e72e2bdd9b80cab862

Threat Level: Known bad

The file 078f9fcdf77fb93ae028eadb4d6c4e89.exe was found to be: Known bad.

Malicious Activity Summary

privateloader risepro smokeloader backdoor evasion loader persistence stealer trojan redline @oleh_ps livetraffic paypal collection discovery infostealer phishing spyware

Modifies Windows Defender Real-time Protection settings

RedLine payload

SmokeLoader

PrivateLoader

RisePro

RedLine

Downloads MZ/PE file

Drops startup file

.NET Reactor proctector

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Executes dropped EXE

Windows security modification

Loads dropped DLL

Checks installed software on the system

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

AutoIT Executable

Detected potential entity reuse from brand paypal.

Drops file in System32 directory

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Modifies Internet Explorer settings

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Runs net.exe

Checks processor information in registry

Creates scheduled task(s)

outlook_office_path

outlook_win_path

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-12 08:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-12 08:56

Reported

2023-12-12 08:58

Platform

win7-20231130-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A

PrivateLoader

loader privateloader

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48C294B1-98CC-11EE-9E5B-5A8BD08D54B5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48C03351-98CC-11EE-9E5B-5A8BD08D54B5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48CBF321-98CC-11EE-9E5B-5A8BD08D54B5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2185821622-4133679102-1697169727-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2240 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2812 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1256 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2556 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe

"C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.youtube.com udp
US 193.233.132.51:50500 tcp
RU 81.19.131.34:80 tcp
US 193.233.132.51:50500 tcp
RU 81.19.131.34:80 tcp
US 193.233.132.51:50500 tcp
US 193.233.132.51:50500 tcp
US 193.233.132.51:50500 tcp
US 193.233.132.51:50500 tcp
US 193.233.132.51:50500 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

MD5 4c2d7fa0225cbbc6024d57d73ddd2fad
SHA1 f4567eaab7ae2c5f06c51adcca873ea711add9ad
SHA256 bfc27e4b20682d136fb8e67a68342858e67a68677db57d93c557217787e37f47
SHA512 c8e0fdf65a712361a2019c2b2bf3b4efdfb79ce27fe556106714b807b7d11b86618c0fa5fe2b829a5c350d586b6e715a4b2ec8922c08b7b0ee414831c107c8bb

\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

MD5 af9bc78632dd29cfc03cb7ea28ca109c
SHA1 10ab4aa11bce02bdd89a0b83b2dfd664c822e845
SHA256 09ca8d8dc937c214acfa446856d2d581ebfe3eafd714b1ed8476eafbb584bfc0
SHA512 4f0dda6b2cb63b7ac9fac0c7bbe0b00c9b7ff71264b817046b5e6b3479850a75fa6bb9d37cd382b9eda379b4f4c80aa26fb6fcb92985407be04cb20942ff641f

\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

MD5 b3aa90e6a654d56d25035d0a5a28cc6f
SHA1 66843c6e6fce2223d0f6df40b51b9f3becbc2404
SHA256 9b75653079a704051bf7b56374aa6c23eecbed90dbdaadc6c12eebfca61eb35c
SHA512 b94947f0c442373764b6fd4c655aa23e57096ed2f7abc429aeb3f421b01d7816daa884adf622b92d4daf804d22d7c58bd23c18d08412b8c9ae93cdb7128cbfb8

\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

MD5 e7e277a6147133c7cecd80af49083900
SHA1 01c9a5b63416c13a2c11c0f010640196f35befe3
SHA256 8e0d58c7315f6f970ac3be9fc4373a1da3373a017edab993425f0e18a506de17
SHA512 1b88bd2d794a443d47292f897474d9dc8026d2a669524736b51c80e03cac849254a79401a42673ab8a7587b8dbd4bc2133b714de46048aa18e8a85828937d482

memory/2976-36-0x0000000000510000-0x000000000052C000-memory.dmp

memory/2976-37-0x0000000000540000-0x000000000055A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48C26DA1-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 7cb3601d735ca09cab2c4b45512163aa
SHA1 7f1f1146fb55d0ee96c33e5e6f5b59c141306f35
SHA256 5e8f73c33311cd9a4ee5b654b97240515db482de026e941117f237aba08c0fbc
SHA512 aa18c3a33685ef4f560631b43a6650c19d7561011691e11af44a22bf7c7f5c6bb34a7d110c44370876c651cb6140c4a163872a07a73588f6e002aca6809eff1e

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48C991C1-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 7db80e1369f04c32f0974635a4334d99
SHA1 a586f819f21d42d0e2e498a385af7e693ff5e1b9
SHA256 96cf96c392f04fba4a3f765fa7f2c62d71ad0504ec4019771114b8185a802ec9
SHA512 bca96dcf5c22334a49060923459ea4d52198022b76eed4ad98ea6dd2e8ed739cb896bb4c7901b698efbed39f8a96af11d07746a1995279f5ffba023c28c2f4b2

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48C00C41-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 9c08ea932a5338c8c7089f451522c4f2
SHA1 0f1a9aad41e1232587c30ac4f14fb36903ac20c4
SHA256 3a34af11f3db3b9a3e8963a0f869aaec4406aa85057cfb5c34328ea0f19bb549
SHA512 718cecde7af3b8f0d851d923401bf433a4f3599308793ee5f98ce808ebe8796deb2cf991c7d272f0152f26c10c1dddf676b85e850bbae8be970475886de2c4d9

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48C03351-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 dae165ef917b3bac3915375c5e08636b
SHA1 024cd9f0d0f60e9480eae4277b859ee4358c83bb
SHA256 2e88726cdb63d8b7eb2e3512aa92395874b41bfa481fc0f86d8d3c8d7c28f70e
SHA512 9e1c9f02b623efa5b7e0537cbea120a4f8c0c2996e73c4215fad9425fc9457fc578a63da0e167e6f70c862f1ff446c50c0bcc31418f4a41521780f6cf48a4c35

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48C73061-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 99c08e8975432c8783ebe3bcd5c9e352
SHA1 a681aeb6bb2331f3a3aa37a05401969b4bc7d5f7
SHA256 cec75304430965cccebdf02efa5b33d8f7ff7a4b8c8220941bcf95cc77c2d787
SHA512 915a30705e07ab44cd2bf3fcd69febfd9d5ce482e1511f5b5074e6a5701ffc55b866e2ed56499e6fa88d3241e0ca6190bb15f8ed5c29dd64b5cf1de56eda402a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48CBF321-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 8bdbe043639fa95552891ddf480d51fd
SHA1 e7a8a301eb2331b452a344131538601d04019893
SHA256 26dd67873882a45dcd5796d1e2998229a246ca5ef9fce574c9ac6b429910310b
SHA512 78c0c10969ece8898e2fb5d9c09fd4b7b9f3b2b1aceb35443102bc9a1102e80e36fab8a722b7f9dc04263156ac3018d70a002f3c7e1412b2f493aa79aeb29e2e

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{48CE5481-98CC-11EE-9E5B-5A8BD08D54B5}.dat

MD5 95575b224f42b9222313623e720d6c1b
SHA1 7e969f5912affc9495c4513d641bd9ed1833c50a
SHA256 4bef42ca5669ded5771eb37604d840b892517da60b2aa439dd2be7845f234590
SHA512 e68c2a723cb242fbd217c14961462d7ebeab7877ed14f6e429263e32b0ff675216ca74c058540400214262a38363e921260ec5c9326dd5ab4993898d00b6a374

\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe

MD5 7ab1808a34a6029a06f100a586b43805
SHA1 afb777dc572ad1f20a319687f876fe0761c6104a
SHA256 e49fff8891c08c1e21b6e3ee7fbf4e6bdb76ab1f8a0f63d570ad295833754000
SHA512 2a0419586ee627e659a864f7bcca155d6a0cf3815ec105eb34cc40b2c6497adcf21fe63214e1ecd73f173f351888c3b3a812c0af0d988c731c617bf98879f758

memory/2812-55-0x00000000001C0000-0x00000000001CB000-memory.dmp

memory/3328-56-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2812-52-0x00000000001C0000-0x00000000001CB000-memory.dmp

memory/1272-57-0x0000000003CC0000-0x0000000003CD6000-memory.dmp

memory/3328-59-0x0000000000400000-0x000000000040B000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe

MD5 28f0456d7a96687fe5e7c6546ae3c1d6
SHA1 b7dd157bc403a3943b7c8727bbfe22bde1d1ac8d
SHA256 ca963a25bb55341c8b97b05d9fc28afacaa3b55a2b7f0eae5a70e000cc3b15ff
SHA512 344cbc2e278be0609e07a0bcbdfbc0e637c792cc15856a9b5f5ee8bcdfadb8751fea018723fedfbff22e9a5f763f249f3cd43ae31c27fd1ffbedbc2fdffc02a6

memory/3472-70-0x0000000000F30000-0x0000000000FFB000-memory.dmp

memory/3472-72-0x0000000002890000-0x0000000002A25000-memory.dmp

memory/3472-71-0x0000000000F30000-0x0000000000FFB000-memory.dmp

memory/3472-73-0x0000000000400000-0x0000000000919000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

MD5 75bb16e9177829e4c43b7526656a4aca
SHA1 1f5c10ce43d421a56e8b5834b0c373cee07fb9be
SHA256 223d4499240875c8f33299ea0b98108c7eb8b2c299b1450bedeeccf6f9a588d8
SHA512 cc09a714a9cd26ef2947eeb8dd39f72c6a0e4c57f623173192aa0a1ed16a67012466e74f496e63eb2e1b227b067ea046d6f2bbb3cb4b8d413ad0c443d2bda9f0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MZS0HLKS\dnserror[2]

MD5 73c70b34b5f8f158d38a94b9d7766515
SHA1 e9eaa065bd6585a1b176e13615fd7e6ef96230a9
SHA256 3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4
SHA512 927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DSQJ9ZZJ\NewErrorPageTemplate[2]

MD5 cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA1 8f12010dfaacdecad77b70a3e781c707cf328496
SHA256 204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512 977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH89KM4W\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FH89KM4W\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

memory/3472-117-0x0000000000400000-0x0000000000919000-memory.dmp

memory/3472-130-0x0000000002890000-0x0000000002A25000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-12 08:56

Reported

2023-12-12 08:58

Platform

win10v2004-20231127-en

Max time kernel

64s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A

PrivateLoader

loader privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 768 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 768 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 768 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe
PID 2684 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2684 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 2684 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe
PID 1604 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1604 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 1604 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe
PID 2704 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3368 wrote to memory of 2896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3368 wrote to memory of 2896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1300 wrote to memory of 2616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1300 wrote to memory of 2616 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4196 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 4196 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 3152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 3152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 484 wrote to memory of 4904 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 484 wrote to memory of 4904 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2056 wrote to memory of 4036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2056 wrote to memory of 4036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4628 wrote to memory of 1500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4628 wrote to memory of 1500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2704 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3740 wrote to memory of 3500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3740 wrote to memory of 3500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2688 wrote to memory of 5332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3028534956-1709433221-1313273668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe

"C:\Users\Admin\AppData\Local\Temp\078f9fcdf77fb93ae028eadb4d6c4e89.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x40,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x78,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5424759006395791493,3797389307101476766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14498505262747003310,18150790098072885200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14498505262747003310,18150790098072885200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4444876494008914290,12518360206431109331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4444876494008914290,12518360206431109331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5424759006395791493,3797389307101476766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1284240565236497497,13756430949709516551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1284240565236497497,13756430949709516551,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5671432249481396826,5845272996665415246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5671432249481396826,5845272996665415246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3737235479296573945,3981470611112314318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3737235479296573945,3981470611112314318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff304646f8,0x7fff30464708,0x7fff30464718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6925780463672762664,12424803477326082596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ho456Ze.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Gn2qK73.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2492 -ip 2492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1776

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2492 -ip 2492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8236 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12816834850205314895,4604906902647491930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1EFD.exe

C:\Users\Admin\AppData\Local\Temp\1EFD.exe

C:\Users\Admin\AppData\Local\Temp\51D5.exe

C:\Users\Admin\AppData\Local\Temp\51D5.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\tuc3.exe

"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\is-DK5QQ.tmp\tuc3.tmp

"C:\Users\Admin\AppData\Local\Temp\is-DK5QQ.tmp\tuc3.tmp" /SL5="$8021E,8423542,54272,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Program Files (x86)\xrecode3\xrecode3.exe

"C:\Program Files (x86)\xrecode3\xrecode3.exe" -i

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Query

C:\Program Files (x86)\xrecode3\xrecode3.exe

"C:\Program Files (x86)\xrecode3\xrecode3.exe" -s

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 1

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 1

C:\Users\Admin\AppData\Local\Temp\6E86.exe

C:\Users\Admin\AppData\Local\Temp\6E86.exe

C:\Users\Admin\AppData\Local\Temp\73D6.exe

C:\Users\Admin\AppData\Local\Temp\73D6.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 accounts.google.com udp
US 2.17.5.46:443 store.steampowered.com tcp
US 8.8.8.8:53 www.facebook.com udp
BE 64.233.167.84:443 accounts.google.com tcp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 46.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.epicgames.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
US 44.196.235.223:443 www.epicgames.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.16.238:443 www.youtube.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
BE 64.233.167.84:443 accounts.google.com udp
US 8.8.8.8:53 84.167.233.64.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 223.235.196.44.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 71.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 c.paypal.com udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 www.recaptcha.net udp
US 8.8.8.8:53 b.stats.paypal.com udp
GB 142.250.200.3:443 www.recaptcha.net tcp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 t.paypal.com udp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 c6.paypal.com udp
GB 172.217.16.238:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.178.22:443 i.ytimg.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 22.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 220.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 221.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 api.x.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 172.64.150.242:443 api.x.com tcp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 192.229.220.133:443 video.twimg.com tcp
US 104.244.42.5:443 t.co tcp
US 192.229.233.50:443 pbs.twimg.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 242.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 5.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 52.203.30.102:443 tracking.epicgames.com tcp
GB 142.250.200.3:443 www.recaptcha.net udp
GB 13.224.81.67:443 static-assets-prod.unrealengine.com tcp
GB 13.224.81.67:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 67.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 102.30.203.52.in-addr.arpa udp
US 8.8.8.8:53 static.ads-twitter.com udp
GB 199.232.56.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 157.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 68.204.58.216.in-addr.arpa udp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.202.103:443 login.steampowered.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
US 193.233.132.51:50500 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 51.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
FR 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.103.202.103:443 api.steampowered.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
GB 13.224.81.67:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 35.186.247.156:443 sentry.io udp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.219.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 81.19.131.34:80 81.19.131.34 tcp
RU 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 34.131.19.81.in-addr.arpa udp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
GB 142.250.179.238:443 play.google.com udp
FR 185.221.198.96:80 185.221.198.96 tcp
US 8.8.8.8:53 96.198.221.185.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dS7tU48.exe

MD5 4c2d7fa0225cbbc6024d57d73ddd2fad
SHA1 f4567eaab7ae2c5f06c51adcca873ea711add9ad
SHA256 bfc27e4b20682d136fb8e67a68342858e67a68677db57d93c557217787e37f47
SHA512 c8e0fdf65a712361a2019c2b2bf3b4efdfb79ce27fe556106714b807b7d11b86618c0fa5fe2b829a5c350d586b6e715a4b2ec8922c08b7b0ee414831c107c8bb

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Um9hz29.exe

MD5 af9bc78632dd29cfc03cb7ea28ca109c
SHA1 10ab4aa11bce02bdd89a0b83b2dfd664c822e845
SHA256 09ca8d8dc937c214acfa446856d2d581ebfe3eafd714b1ed8476eafbb584bfc0
SHA512 4f0dda6b2cb63b7ac9fac0c7bbe0b00c9b7ff71264b817046b5e6b3479850a75fa6bb9d37cd382b9eda379b4f4c80aa26fb6fcb92985407be04cb20942ff641f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1aY71ck2.exe

MD5 b3aa90e6a654d56d25035d0a5a28cc6f
SHA1 66843c6e6fce2223d0f6df40b51b9f3becbc2404
SHA256 9b75653079a704051bf7b56374aa6c23eecbed90dbdaadc6c12eebfca61eb35c
SHA512 b94947f0c442373764b6fd4c655aa23e57096ed2f7abc429aeb3f421b01d7816daa884adf622b92d4daf804d22d7c58bd23c18d08412b8c9ae93cdb7128cbfb8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 edf2b2514bd574ccef3a3da9d0be4d9d
SHA1 78c247610ff063087c9571c1446778eb32993893
SHA256 13d82ea9734f67a5fff85da945a9e7b49380d2f3917b11e170cea864cef2d5e2
SHA512 5090983fdbe645c7db074e142d01bedd03d1b30ca13ae8dc7a2417f871da5173d1d2ae0f4c084ce423e1c57deed1d27fad77a06fd904d8f2ff7fef797afd2210

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7c89e9212e22e92acc3d335fe9a44fe6
SHA1 c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f
SHA256 18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44
SHA512 c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

\??\pipe\LOCAL\crashpad_3216_OOPOMJKOLDRTKWGC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ci7004.exe

MD5 e7e277a6147133c7cecd80af49083900
SHA1 01c9a5b63416c13a2c11c0f010640196f35befe3
SHA256 8e0d58c7315f6f970ac3be9fc4373a1da3373a017edab993425f0e18a506de17
SHA512 1b88bd2d794a443d47292f897474d9dc8026d2a669524736b51c80e03cac849254a79401a42673ab8a7587b8dbd4bc2133b714de46048aa18e8a85828937d482

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 604a7658afb3aa59cf8ab9bbc100ac20
SHA1 deeefe12ca0e3e5370694b38f2d7fb5ce23db5ca
SHA256 af7237382c51ee852f6f8c6948297dacce1a3ddde3f305d76610b334d535f715
SHA512 c755680e4fae6d5f840ef8e950eb614bff98ef71f436deaab73a880696560b7aa4350970a2f6a004850cf0d05c581566cc4e2a56cd72ebf7e11933cffe13ede0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7c94b94bfcfe630bc7f5e44d5a10f5ab
SHA1 48959704a5cc735a0b8edfda935c7a425fe4ff8c
SHA256 3678c940f2c51e0e54693e6523f44cb28f0b94543ce902c76f8e4b8001e660cf
SHA512 747bf86e36d85098237f0952cb8a352208c0c9d07daaf032aba32039fd5849f1047d8c77a1c0bee19ceb5414e0a3cb9ccfddce1f6d25fe942c25112ae531b9fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 32c587272cc8e26b1cec7da0beb23b38
SHA1 6656b20a010c8cf626962340fa749b1796a13960
SHA256 b620d900d20e6ca6725fe7688f4ea80503402eb8b3537bb81b87c14e679e35cc
SHA512 6631ba38554ff7db96a7bf13bfd7c22c5b5eb74054b740a2eefd96d86d06ccf18cd69235537d53bb38af5af3fcbf0c027ab13356abab3df6c0236d3a4d9b9588

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fd668826a6f5f8b48b80dfbfeb9be2c8
SHA1 a80d01ef1749de1ecda5dde581185919fd46469f
SHA256 f464d0524728a8152b944e23efb914fd99f9d463c18098337de900f8bc356e65
SHA512 a2060fc811709c138ea40bc261a3f61fa4794da179f988d7b53890e3875d7a95f4f30e773634c81f7ff7e4b78dd9490b945cf3143ee3e0d5db6989bfcf9c6bb2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2396a1e5d6a5c3b3f366af506a22980b
SHA1 d4508099adc1896d2933cce57ee049acb87bdb0a
SHA256 3e365fedad30a9fa87ca5553ea8d0772c0bb2b82a8561951c7bd794f39f8c0d1
SHA512 fc93cbd35622b571d40c0d3f113b80df90cd1284e799f9abc78e21e867644f0e02cd5d986483e1c97f206ea5b866c231a1ff018c44683c6daf6755835c87d0ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\323dc16f-a91f-4a41-be43-35154f2bed74.tmp

MD5 f27cd1f89d1a43af3065e4bae1dec46e
SHA1 9c49c774db5629b167035ab5679315c135ff4d6a
SHA256 3e9aa3164494e24a73ef8742a6ac33dcca9c96a954b91de241ea5109943ca0e8
SHA512 4bcfb9c0c7064fc8569cb2a33976a458154597b2dffe299306f4f4f8f585da872aee090fdda19ab0495c7b4ca8bedc95c65d55f743c045cbe2d8692ad0d0a8ae

memory/6812-197-0x00000000048D0000-0x00000000048EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 18b3744b59252204b9d226e5b945cf3a
SHA1 300db58ec4259a889b316012ed063facdcf033d7
SHA256 860fecb3ef41986ac0da1fc4e2010201638ed6e4a01f81cb7d26a328aeba137f
SHA512 a9d396c158ddae6129a7124727a7f6aaf42e49d631a4f10b89d59340056240a9d176c56e6d581928ed2c1628bf0655c2e12df3f4daabaae9f51cff8ed5cf06b0

memory/6812-198-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/6812-199-0x0000000004900000-0x0000000004910000-memory.dmp

memory/6812-201-0x0000000004900000-0x0000000004910000-memory.dmp

memory/6812-200-0x0000000004950000-0x0000000004EF4000-memory.dmp

memory/6812-202-0x0000000004F50000-0x0000000004F6A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d276fddebeac59c602fb3871d016a7b5
SHA1 e7cbafa7b80adff9acf34221205be33c752ac786
SHA256 9a758017f4740a88ea5752e55fb25b998b2d2393d7b804f8fe3614014fd775a5
SHA512 307c0978a01c37443602fc719e5abc51c9fe2895d31366f6255c4228b9d3ac3da6588c9804c6219b5e615ff0e2ecea58469ed943f0fccc57562f5924439459d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6780670d248a0102be06c2a9f37a85a6
SHA1 29710304a0e57fbc240fb729b211c88ef32e59b3
SHA256 d6713245801538e6257598ed2f8dc108db2bb885a9eff1f445f807c8df244205
SHA512 a69ca480e3117c6d98b23cfe993e48e42f27dcc2a0c30dc2d82b6f12365fa4b4b70f0398379b4a831d826230b0f538bff2fc83905b645c4e5faff96aab027120

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

MD5 d55250dc737ef207ba326220fff903d1
SHA1 cbdc4af13a2ca8219d5c0b13d2c091a4234347c6
SHA256 d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd
SHA512 13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

MD5 909324d9c20060e3e73a7b5ff1f19dd8
SHA1 feea7790740db1e87419c8f5920859ea0234b76b
SHA256 dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278
SHA512 b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

memory/6812-503-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/7484-508-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cf7d51d83705db8cd0518a209f0672ce
SHA1 42770583f9b4999e22598d03fb3d2f71b0ef2493
SHA256 d1fc16a9559c6979d16570ee763ae4f44e90169dd7a4cf04af81200213204438
SHA512 337cec4ce44325b0e824d60a3b5a7828605b69c7db27d82ee6c2ad503ddae5f7ce9fdadb1fd41386b5de432af9275dde063daf7ead51632a19b91958fc38e935

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d7b2b29ef1d9a33e61e1167984c8ca3e
SHA1 9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34
SHA256 7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2
SHA512 3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

MD5 b3ba9decc3bb52ed5cca8158e05928a9
SHA1 19d045a3fbccbf788a29a4dba443d9ccf5a12fb0
SHA256 8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4
SHA512 86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/3280-631-0x0000000000BB0000-0x0000000000BC6000-memory.dmp

memory/7484-633-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2492-648-0x0000000002690000-0x0000000002766000-memory.dmp

memory/2492-649-0x0000000002770000-0x0000000002905000-memory.dmp

memory/2492-652-0x0000000000400000-0x0000000000919000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

MD5 28f0456d7a96687fe5e7c6546ae3c1d6
SHA1 b7dd157bc403a3943b7c8727bbfe22bde1d1ac8d
SHA256 ca963a25bb55341c8b97b05d9fc28afacaa3b55a2b7f0eae5a70e000cc3b15ff
SHA512 344cbc2e278be0609e07a0bcbdfbc0e637c792cc15856a9b5f5ee8bcdfadb8751fea018723fedfbff22e9a5f763f249f3cd43ae31c27fd1ffbedbc2fdffc02a6

C:\Users\Admin\AppData\Local\Temp\grandUIASpysa9JBccEoT\information.txt

MD5 b7977b3761088692b8e293ef5cdd7dd5
SHA1 09e379b596942d4a2e9c92fc52f7f95d6fb3068c
SHA256 395206d64f24594613e42fdaec46e6fa08a351e3de5b429092ca42f53215a6e4
SHA512 b6bc6fa6b822e22cf64d70280f4d96910a17aabf923c4d98e56cd7ee9b1c2463e36e6165c2d1a0851015f434bbe17997eca83834c0500cd6ce11f7ff96cef54a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5f7857fdb22315bc5b77383b1d4b8aa8
SHA1 a799afcf5a40dcc4478261250d7da56f8df02e58
SHA256 bb0cbc0d2e8733089d47766a8eca0aa58e3756ef3db8ae8cc94dc616872cdd24
SHA512 fb0b113c8b136bd9288842295a78a8d3bf108fb2aa4936ffb08607a21f418d1fa0c7a82d370edfbb9a2791c5b73abbfc7c4affa3bda86811f54b71d0a2d89440

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7ce86ad3d292e6ace9cf13d73d8609f8
SHA1 ca6f12f61a377dfb99bcb59922c39a39ef376e5d
SHA256 641341a92f752cf6e630431947ee5cc7cfa63a77c4a29deadd7f48b50ce94e89
SHA512 bd5975e72c6e1c99bd131c5c4034e2defec8540df6de6870067e7a254fe0b53ce9c4f5b7ad66cfaeb43776c67342e96023351a6ea34780454848fb5178c28d43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4a1.TMP

MD5 22eeb91f3b9e9203a2ccb8eb104c521b
SHA1 93593040f5dfae6d5a00b9b4cf547b36b198b4a4
SHA256 e1ddbdef6a1efb2e62b321d1d411d694528982a49439990d0914c2297864f77a
SHA512 680b018a743764a3b01e27b4aee682c71b3bdc8d909f840d7400e96aa41d689c024f1af9df318d15119caf8bcdabd3850daef276977999d91f66c974dcc3f7dc

memory/2492-843-0x0000000000400000-0x0000000000919000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/2492-879-0x0000000002770000-0x0000000002905000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 6734c77254d0f954ea25bfbcb4837b3f
SHA1 553d3ccde9f2b694d684d090dcae2f68ae94eb0c
SHA256 62d24bd109a65132c4197fd708dc3dee0b102df2940990124b482b2c8aa0b785
SHA512 46be7c3c548fd07264628c9e15969d285b6e08fb291b1932946736fa5dff3ea374e44632f89f150bc7b8e8b192ea57b5d14698601ee4d0a107fb2354df62afc9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a28dec0a790391491c356e0ec5fc3c98
SHA1 3806d149f93671726c7dde60c066a080a9301e63
SHA256 481049fbbe97d08991740866f3dc5030919f7595351630f241c7314c7a2804e0
SHA512 138e8bdb2e908328235b68b1ebed34453a1072994044103de080d68b36f23fa3f60fb1083233c569bf4a824f7bdbac427e0e200747de5528359613bd19411a62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 c6ff273753694a3dcd35b1a3462f3115
SHA1 93611e945dd582da19931cda1972fabb78a6e29b
SHA256 843398a63d999e6735aef0e599431d531895f354324dae656fbe4e7e95b1f4e5
SHA512 6c912e150d23d8a46f467f5daf4bf58f53c6284fdd6c1b2f75811adedb0583c7a782477a5d190f2606ee5e4203c3c0d5571d61a46b3ead26aefb8e06345ceafb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 496d50969485119261d4573052fed274
SHA1 9b040842fad493f31bf0ee7836337c3eb93fc295
SHA256 69f0af33206a7bd86bb38400d437d2447832560450dc2ae41690f7dd32c0ad07
SHA512 da6dc4ec4f5d9fa3a357dd0ddbc9877cb4b50df50ad8ff3187a7dd9bff5625def0f811eae488bd594bc5b4f94511d70a6d5012f890bcf267d2ca1817fe1d86f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 27ba5f751517ce60fd90827cfb4b96e8
SHA1 f86071dc0bed05e8827cc8ef2d0a58748b706f2b
SHA256 172c3c93bd668716c6b3756f802780297252270338b6b372ea624d93f17592dc
SHA512 ac5349e873778393648476edbff886c17d40c40291422b141d8743d1c21e2eae447a410eb564c4c210d2053363eb2f678eb28a5033b59b6f67580bf0b9739f60

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9c9f55b02db17e54b4b523c561d82d77
SHA1 33c70435f5c8dd583e76c1b997c234f33016990f
SHA256 1a95f1e3069d85f4317597a576243d61c7f91bad92bd12ed8925759bb1d6233a
SHA512 08dc9095552daafe2d612727c49143e55529975187af310a59be4ab3cc8a6bc48d5477dedba96d622a098e2d9a02aefdb3162893b8778f29238047190aff8f8b

memory/6668-1166-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/6668-1167-0x0000000000FD0000-0x0000000002486000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

MD5 5b11fdb9db6d3b0ab01d29311eb1beda
SHA1 08e8837d100555812ee973d78b076159498ce1c1
SHA256 4ff6c26620c8b4951a0bdfe7588174a2b2f1b43fe2d4da274d0f407a97f570fd
SHA512 86811da37f70e9d5260094108f4130f949fa15b1ead226ff5e7994325bbecdeda2c479ae2dc56f1612222566109761e33e11bb6b9110e9e36128daa1eb00cf86

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 cde750f39f58f1ec80ef41ce2f4f1db9
SHA1 942ea40349b0e5af7583fd34f4d913398a9c3b96
SHA256 0a434be25f55f27ce0adbdfb08efeac1da01125b3e9194a94669bc7e9c6fe094
SHA512 c181faacbef70f8a91606943470af50cfd443958c48601051371ff5d9bf66bb9ec794571b05a347a7f5776f06484dc007f535591d2f5e1c57e3c0ee04f3e9580

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 a715d27376282d7083b1294a45b5116c
SHA1 73a90baacc36bb8c66eb2e2df7e32867ac26133a
SHA256 68505c145568cbcbd71fb35e050e1912040b8f0f96327becb85e193561434a6b
SHA512 6f2e45d751a0716e7ef7999fb5980b9cc0f2d4e5ca414452e5441412c5c88a8bb019b85c751b2a34672b3020c65ffb58a3261a5139c45fd7fb8614cb06937507

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585752.TMP

MD5 2fce78e43589fadb47dcc1fc44383c0a
SHA1 e4b96f0a04443b5f27ef7902581cc60da53e146c
SHA256 a540f0712190b1794dd42d5b19784b2b727c55d711c1ae6d201f800aebe4893c
SHA512 0d5f8ede9b11fddab2c2b8e0867877da8122a0865ccf76b5baff223dfe3e09fc539c4cb36873a645fd5ee5537ec5e40ae20765c3a1a9f748342a5397ee92ec88

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa1cc24853b99a35c5638bc216892ae0
SHA1 74486d4999186ec36952149c8933958afafb6d2a
SHA256 f4b274c223e10a695fcc0fd06610c613ae4c7c5173d6b64065de0605147ef9d8
SHA512 76022d3c67cf7c01e6e5039119bc5a01439a888b73b6b0691ede925a1529f03b433bd72c8d787e5f224f1017bb8fb7eb3f47959145ad2aadd1eee7c652303c5f

C:\Users\Admin\AppData\Local\Temp\tuc3.exe

MD5 94649f283776ce0bc4d9480e32582a50
SHA1 52c15c4f177269217727342d2f318a3d78b449e9
SHA256 198cf5578b0dc9150e020727d05d910dd8241941bd7ffe54fa494f799860ce8a
SHA512 b342818b22ab480acb80738b0dc2bd7cb2e67fe57c00009f949ba04410c9ce692d6428b391725a3e88fe59cfff7da211c23075ed5c6052c66e5c2768725a5f67

memory/5168-1215-0x0000000000400000-0x0000000000414000-memory.dmp

memory/6312-1213-0x0000000002730000-0x0000000002731000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 99a4172e07fb4619e4e2960607f082f2
SHA1 0f827a54a776bc65c319f165ab8568db550f2897
SHA256 5c5d53c2d27b987dd03014bd1627b6af11248612dfe101e6f84cd450a03658cd
SHA512 01121b0cdad5a9c8b7acd8e77c236104441cc242699e4aa38f6f5cec9832a297c3a45f4955f36b150687c7046110bbd42f9dd4b366790d17f88adbe482e5ccbd

memory/5140-1239-0x0000000000610000-0x0000000000611000-memory.dmp

memory/6668-1226-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/1724-1367-0x0000000000400000-0x0000000000785000-memory.dmp

memory/1724-1370-0x0000000000400000-0x0000000000785000-memory.dmp

memory/6324-1369-0x0000000002BB0000-0x0000000002BEC000-memory.dmp

memory/5672-1375-0x0000000000400000-0x0000000000785000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2a338df9bcf25a99c74ee9ba33df2a43
SHA1 c74af6958d0e56c03159d230b646d6619f5552b6
SHA256 96c5dca031d10e7b31b432244c860c54e80d489428b68d0b07177d12692681bd
SHA512 7197593b570783b1d5f944fe66c515ef0a27e8ebcab48f9c8b03eb54391491b0492cf0a443449caec86964198618e8c5b6eb6c9f4851f6c222953a7fdc2914d5

memory/5672-1383-0x0000000000400000-0x0000000000785000-memory.dmp

memory/6324-1384-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/6324-1386-0x0000000007CB0000-0x0000000007D42000-memory.dmp

memory/6324-1387-0x0000000007EF0000-0x0000000007F00000-memory.dmp

memory/6324-1388-0x0000000007C70000-0x0000000007C7A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 19da989f281d58cc7a188984515a04f8
SHA1 774f707cd813c4e172286bb0197ae5f642da490e
SHA256 d3d932f37283cce0c1dc0788911b0a821a45c3160e529ca19bf2e3073b2fb7e1
SHA512 10256562b19d4aa3a81dc9da99c271d2d7506f1c560b73554e0b1cb02c4113e2caab444b2c6ad8e45ec672943be236393748c220bf7ca001f6b0bee3b81779c7

memory/7412-1400-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/7412-1401-0x0000000000340000-0x0000000000834000-memory.dmp

memory/6324-1412-0x0000000009060000-0x0000000009678000-memory.dmp

memory/7412-1411-0x0000000005350000-0x00000000053EC000-memory.dmp

memory/6324-1413-0x000000000AAB0000-0x000000000ABBA000-memory.dmp

memory/7412-1417-0x0000000004FF0000-0x0000000005000000-memory.dmp

memory/6324-1415-0x000000000A9E0000-0x000000000A9F2000-memory.dmp

memory/6312-1414-0x0000000002730000-0x0000000002731000-memory.dmp

memory/5824-1421-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/5824-1422-0x00000000002A0000-0x00000000002DC000-memory.dmp

memory/6324-1420-0x000000000AA40000-0x000000000AA7C000-memory.dmp

memory/6324-1424-0x000000000ABC0000-0x000000000AC0C000-memory.dmp