Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2023 03:33

General

  • Target

    6e79f2040a447c4b7c71d717c1bc47e4f3e5bfeb0bf061fd488a0114aecf5d27.exe

  • Size

    1.5MB

  • MD5

    12502496d57a7e02b23f53a30489a834

  • SHA1

    3ab72a2a045f0ea002c3a41c9b658754eb304f89

  • SHA256

    6e79f2040a447c4b7c71d717c1bc47e4f3e5bfeb0bf061fd488a0114aecf5d27

  • SHA512

    2d5eebe9e4c2bd540a2f4e7c624e2c181e8e4271096677fbd527994f70c11f2a38f03b2dcd8da91b8baafa86d4d7863c698a551e7425df30784e8f2d6035f82c

  • SSDEEP

    24576:OyI7LmJsD8YYfLnV3/rc9Oc9DXZfJUyOZ6rFWR0L5QT2Y21/qeT45Uyk6bfdh3b:dSSJ+xYznVgIclXBOyOMrnCT2D/qc4qE

Malware Config

Extracted

Family

risepro

C2

193.233.132.51

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 4 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e79f2040a447c4b7c71d717c1bc47e4f3e5bfeb0bf061fd488a0114aecf5d27.exe
    "C:\Users\Admin\AppData\Local\Temp\6e79f2040a447c4b7c71d717c1bc47e4f3e5bfeb0bf061fd488a0114aecf5d27.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yP0ee34.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yP0ee34.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mI35my5.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mI35my5.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
            5⤵
              PID:5068
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5692
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
              5⤵
                PID:5708
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
                5⤵
                  PID:5684
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                  5⤵
                    PID:6300
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                    5⤵
                      PID:6288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                      5⤵
                        PID:7884
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                        5⤵
                          PID:6980
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
                          5⤵
                            PID:6200
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
                            5⤵
                              PID:3836
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                              5⤵
                                PID:6308
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
                                5⤵
                                  PID:7364
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                  5⤵
                                    PID:8240
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                                    5⤵
                                      PID:8348
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                      5⤵
                                        PID:8524
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
                                        5⤵
                                          PID:8812
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
                                          5⤵
                                            PID:8848
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
                                            5⤵
                                              PID:9192
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
                                              5⤵
                                                PID:9128
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7592 /prefetch:8
                                                5⤵
                                                  PID:6752
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7592 /prefetch:8
                                                  5⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:7440
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
                                                  5⤵
                                                    PID:844
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
                                                    5⤵
                                                      PID:1028
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
                                                      5⤵
                                                        PID:9072
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
                                                        5⤵
                                                          PID:5392
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1
                                                          5⤵
                                                            PID:4884
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8828 /prefetch:8
                                                            5⤵
                                                              PID:6276
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,7528074843375540525,14194486799433095006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
                                                              5⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:6428
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3628
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                              5⤵
                                                                PID:4952
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16458421742753209517,15217215773614099499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
                                                                5⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:6532
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16458421742753209517,15217215773614099499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                                                                5⤵
                                                                  PID:6520
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                4⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3048
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                  5⤵
                                                                    PID:2984
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10124935916740295792,12075624009989569126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
                                                                    5⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6240
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10124935916740295792,12075624009989569126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
                                                                    5⤵
                                                                      PID:6224
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                    4⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3268
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                      5⤵
                                                                        PID:2388
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11778470388282646891,3833337833562224419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
                                                                        5⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5808
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11778470388282646891,3833337833562224419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
                                                                        5⤵
                                                                          PID:5724
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                        4⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:848
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                          5⤵
                                                                            PID:644
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6979565424424375004,14194412467244699307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                                                                            5⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:6564
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6979565424424375004,14194412467244699307,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                                                                            5⤵
                                                                              PID:6556
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                            4⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3792
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                              5⤵
                                                                                PID:5000
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11130829803003292319,3606895462984940005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
                                                                                5⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:6232
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11130829803003292319,3606895462984940005,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
                                                                                5⤵
                                                                                  PID:6216
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4176
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x84,0x78,0x16c,0x148,0x170,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                                  5⤵
                                                                                    PID:4512
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,294383348735836878,5284420671933942210,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                                                                                    5⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:6548
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,294383348735836878,5284420671933942210,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
                                                                                    5⤵
                                                                                      PID:6540
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2320
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x78,0x16c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                                      5⤵
                                                                                        PID:3444
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10639918113967216916,15822875862343294510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
                                                                                        5⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:6684
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10639918113967216916,15822875862343294510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
                                                                                        5⤵
                                                                                          PID:6676
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                        4⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2312
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                                          5⤵
                                                                                            PID:4172
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7639557270042777283,9385631415125073355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                            5⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:6584
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7639557270042777283,9385631415125073355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                                                                                            5⤵
                                                                                              PID:6576
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4308
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff534046f8,0x7fff53404708,0x7fff53404718
                                                                                              5⤵
                                                                                                PID:4272
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10817480657007990806,9816302875851751740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
                                                                                                5⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:7452
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Na7881.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Na7881.exe
                                                                                            3⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Accesses Microsoft Outlook profiles
                                                                                            • Adds Run key to start application
                                                                                            • Drops file in System32 directory
                                                                                            • Checks processor information in registry
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            • outlook_office_path
                                                                                            • outlook_win_path
                                                                                            PID:2496
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                              4⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:5320
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                              4⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:7116
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1736
                                                                                              4⤵
                                                                                              • Program crash
                                                                                              PID:8624
                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7WB1HJ42.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7WB1HJ42.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:8304
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 8304 -s 1008
                                                                                            3⤵
                                                                                            • Program crash
                                                                                            PID:8560
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                        1⤵
                                                                                          PID:6136
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                          1⤵
                                                                                            PID:6128
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:8152
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:8224
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2496 -ip 2496
                                                                                                1⤵
                                                                                                  PID:5900
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8304 -ip 8304
                                                                                                  1⤵
                                                                                                    PID:7928
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:6164

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31af1c33-e876-482d-b85c-76aa8ef0f5ef.tmp

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      40591fd9340cc43bbfeb9af6457e71e8

                                                                                                      SHA1

                                                                                                      35fb331aeb7f6462569f6f4c279c94fc645d3801

                                                                                                      SHA256

                                                                                                      490bdd2b8960a59a44875e7b8c974ca3352e6bfa2d31646295368e8c831feeeb

                                                                                                      SHA512

                                                                                                      6182ab450af710429241a97d8a2854f78db13f0ef55f730876300a918b7f742be045a5661ef7a82aff13e0f6f9fa7bf9b573c921aa309e83b6e5d7baf8d0dc51

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45d6cb82-81bf-4ee8-893b-bbe0b2249df5.tmp

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      f90053d7c68b28bf69a5e227941f6c39

                                                                                                      SHA1

                                                                                                      1bac6309d0baad8934cdf3c5a19523f7e1b792fd

                                                                                                      SHA256

                                                                                                      2f3c3ea5ef98b0e8834961e30a94429157a994124b5fb533b917e2eed3ef0125

                                                                                                      SHA512

                                                                                                      ea364c5f7eeaa40063b65391b18f6f857281d1529f9a7e2c608565805232398fed349b6151d1ac6a935ef90373e65556418334dd617e94c66a0c233cf4bf54ed

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ecffe49-1249-4f29-b02d-d139e9655588.tmp

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      b28a7801640bf5a45d8a5accec2bf53b

                                                                                                      SHA1

                                                                                                      8d56e1cac5ceaaecb0a4b766e8b4e8daf72de645

                                                                                                      SHA256

                                                                                                      6c962f74da7d050f23b1295a075a8c84082aced4b1ca077c3b0c857efe926d6f

                                                                                                      SHA512

                                                                                                      efd584fd2676390c69972a8e7148df4bce1712cb9082a901c3759145562e73b6f13d6c254a37ab6b5a09f82a39460a7ed17a49c7e3d878370d7c74717f260f35

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      d94c59e136e2bc795637c1c05e315e35

                                                                                                      SHA1

                                                                                                      0ec32d5c51c34e9215b5390e7aa4add173310f01

                                                                                                      SHA256

                                                                                                      ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

                                                                                                      SHA512

                                                                                                      57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      890585f0e978711e84e103f4e737e1b8

                                                                                                      SHA1

                                                                                                      12b9a7b4a1a016c8a0d4458f389135ed23574e27

                                                                                                      SHA256

                                                                                                      c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

                                                                                                      SHA512

                                                                                                      246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4386eea1-ea9c-4b7b-b4e3-661fb0a1d8e6.tmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      d45638203adcea42ef8923198c71393d

                                                                                                      SHA1

                                                                                                      06bdc3b5a410bf386f495b8ae2d4507c50cae8cb

                                                                                                      SHA256

                                                                                                      26dad72bbe4f0500579c0541da644a50ccae3bf8d3d1340d957952ac0f42b026

                                                                                                      SHA512

                                                                                                      bdaddf14c5283dd5cab612b7e8f50b1d381ce64038cef464fbcb18417e02047b7ba85e8fcc60cf9153a7ed578f6b45c7a6b784ee1b21d148a0f22592b0759a36

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4566df64-067c-41d2-a5bc-b8a3ccfd9780.tmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      3efa33ce312a5a33b0c4d3220efc24bf

                                                                                                      SHA1

                                                                                                      836c56fda1dcbe33705b10cc6dc8066a9b2c9bbc

                                                                                                      SHA256

                                                                                                      a838f7bfa9fc33802cc38ae5640c083b3d3a15076f1c7cf855751d296e93dc78

                                                                                                      SHA512

                                                                                                      3564edc7d6fe63ba2182dabf00b61a5856f7c38005d356c622b3461f3ed728d4ca9325468e1f2531a94431c86a7ae8d3c23f71c219433eb4cfc45cbff18f6807

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                                                                      Filesize

                                                                                                      20KB

                                                                                                      MD5

                                                                                                      923a543cc619ea568f91b723d9fb1ef0

                                                                                                      SHA1

                                                                                                      6f4ade25559645c741d7327c6e16521e43d7e1f9

                                                                                                      SHA256

                                                                                                      bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

                                                                                                      SHA512

                                                                                                      a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                      Filesize

                                                                                                      21KB

                                                                                                      MD5

                                                                                                      7d75a9eb3b38b5dd04b8a7ce4f1b87cc

                                                                                                      SHA1

                                                                                                      68f598c84936c9720c5ffd6685294f5c94000dff

                                                                                                      SHA256

                                                                                                      6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

                                                                                                      SHA512

                                                                                                      cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                      Filesize

                                                                                                      73KB

                                                                                                      MD5

                                                                                                      6dfb28a6390f63171f06e77ea2e7465a

                                                                                                      SHA1

                                                                                                      415dbb91566f810a83c3c6efa2e4dd2c4084c276

                                                                                                      SHA256

                                                                                                      3cfe4ed506d1ee431d75dfab4e2f1ada2fd30e8d7664061d9fd706b3ed9c4b98

                                                                                                      SHA512

                                                                                                      333b19faaa15c61ee44793bb4c2222663070ebf6463fb85115f561bba0abff09ab8a88f5dcad8f31ccc496b42930d137c865515c78ecb0a0adf994d64354ba56

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                                                                      Filesize

                                                                                                      33KB

                                                                                                      MD5

                                                                                                      909324d9c20060e3e73a7b5ff1f19dd8

                                                                                                      SHA1

                                                                                                      feea7790740db1e87419c8f5920859ea0234b76b

                                                                                                      SHA256

                                                                                                      dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278

                                                                                                      SHA512

                                                                                                      b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

                                                                                                      Filesize

                                                                                                      200KB

                                                                                                      MD5

                                                                                                      b3ba9decc3bb52ed5cca8158e05928a9

                                                                                                      SHA1

                                                                                                      19d045a3fbccbf788a29a4dba443d9ccf5a12fb0

                                                                                                      SHA256

                                                                                                      8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4

                                                                                                      SHA512

                                                                                                      86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      4b1fec69d7406317ca01273f2e107aab

                                                                                                      SHA1

                                                                                                      9b858363b242e75af07d485f39dab8c65cebe8ee

                                                                                                      SHA256

                                                                                                      116dcf9901ccd0a31b14998a9dcfc10c64b38f4f0f286e7c1357c9c35251da8c

                                                                                                      SHA512

                                                                                                      4c82469b8c2eb792b52b855e8034273c6490efd4470969eb0123a22d763ac01158d63036353440d6c186eeace047a11dc75ec354cf3ccc5954297f3606dd966b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      22bb10250e37a9256bc6c379ab57e00e

                                                                                                      SHA1

                                                                                                      8f2b1e0e8fa221b6690ceb921733675287cce98a

                                                                                                      SHA256

                                                                                                      cb18fe22704b990a4dc0c6aaa9277aec346c0d46999c9b1ebcb4a5cf2453a383

                                                                                                      SHA512

                                                                                                      06b030528ffb11fcd8b1eccdc9be05238cfed099a23ffd5fecd7bbe01820e93928a1267a0592a4a44c3f73ed86726ae0b26598acacdffe333ccf8ae4169d76bc

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      111B

                                                                                                      MD5

                                                                                                      285252a2f6327d41eab203dc2f402c67

                                                                                                      SHA1

                                                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                      SHA256

                                                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                      SHA512

                                                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      b529c35d67c87ccc3675bc8240202083

                                                                                                      SHA1

                                                                                                      7dbfd4557b0735e69aa591766a306bf756c17ba2

                                                                                                      SHA256

                                                                                                      7b2a67b3114e7e95c218648127d05ecb87ce7ed1c1799a723d5cbd2007d88952

                                                                                                      SHA512

                                                                                                      93d9b4be70eba85d5162272b7469305f78dda6e110ce6ff619664c4501080ed78bf85580d28a97083e2b2927b0232d050a2cb58115ed1a9990dc816a4ea6be54

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      d83b67cf5b5c6ec1bad3d485bf563dba

                                                                                                      SHA1

                                                                                                      bfdd6b1a9a87969dd3556a46f1ef568f44d4772f

                                                                                                      SHA256

                                                                                                      de904f8571739e394b973f4d7ff8cbec6353b5be54144a834fcbc7382c0df358

                                                                                                      SHA512

                                                                                                      a843a18ee71dc44fa2319cdf49dcbac3bff5feba8d8ba2ac4749e29dcdd9f67857a2bcc6a9e20d2daf87b701ed2885c8e61d73de54d657c8c034224b36c6c1ce

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      731584365d66e17b55dd9208790fa8e4

                                                                                                      SHA1

                                                                                                      c016c17ce3bfa68de33f1b2b06c8645f1f7d000d

                                                                                                      SHA256

                                                                                                      71ae75f91fe803b35888f8018bd83c11d5b555850d94abaa7e14d0ecfd57230b

                                                                                                      SHA512

                                                                                                      47b976755c9c461911b84885d15aeb3fd195f773e1467f2ffed6041e948181c6df2cf5f82e98693b8290ea5deba30dfb40fa7ac923515bbb6ebc8ccecc2578c6

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      18d7a475f215b30a89498ca38cd2dae9

                                                                                                      SHA1

                                                                                                      2c8fff0869e3a50ad41a645749f8b630b8631a9a

                                                                                                      SHA256

                                                                                                      f91ebdb54316648fdcc6f4eb6721ed5615913f4b9278634292f989f0982be73d

                                                                                                      SHA512

                                                                                                      ff2bb2c1a8ce1d36e364a5421f21b038cc81985055276cac245c17c45e131e3724277aa321a63b50c285a84bbffa1ec59a041e6ea225d246087fb47e2fbccaa2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      9KB

                                                                                                      MD5

                                                                                                      19687ba598929ea8c3e7e061116cacab

                                                                                                      SHA1

                                                                                                      69007d866062a68b031207b2512b928891f06930

                                                                                                      SHA256

                                                                                                      c5c9b882e2c282781022716a24a53cd9e53dcb332c512653fbcdfa6b549ace70

                                                                                                      SHA512

                                                                                                      e28ba2caac769a886131345103f6f3c9cb3db2c349cf825c6d4a61f2bec08a9e108fabafa5556a3b90ce9875cde1732b7b34e62bf34bb346023c4c7c96d76080

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      3af254defbcb1d67f602301304b2601c

                                                                                                      SHA1

                                                                                                      e12d33608f44e4b9948ff96fcdf88496bcdc8be2

                                                                                                      SHA256

                                                                                                      9ee9d63a90ae1705e85f4c8147e8e6965015f7c8c1f118bc54479bf638cf1b49

                                                                                                      SHA512

                                                                                                      d2a9cea225e68fbe828e2f0358f497c778a20dc6cdf4d59d624d8505366262659ece767858ade275ff914336c61d8524ca5a6eb79e820e60613de3a40893235a

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      a553ed37741112dae933596a86226276

                                                                                                      SHA1

                                                                                                      74ab5b15036f657a40a159863fa901421e36d4fa

                                                                                                      SHA256

                                                                                                      ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

                                                                                                      SHA512

                                                                                                      25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      89B

                                                                                                      MD5

                                                                                                      bc1bb8177d26b769e46f57daf08d95d7

                                                                                                      SHA1

                                                                                                      a4eb841c95c4587c1bdeb2524bd234ab8f4769ae

                                                                                                      SHA256

                                                                                                      5b9ee5c2713e523188773cfc9321f1625473087e6d337f6933dc94c650a78911

                                                                                                      SHA512

                                                                                                      9b8083948cc18764df44c7a4aa922bd8368f77512991087fb6594b9abe9a20188b55bcfea663b7cb62452b0de5f3bf87fc3b59308748c208a960c402a36cc4aa

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      146B

                                                                                                      MD5

                                                                                                      514858451a42129994184fc6d4373d9c

                                                                                                      SHA1

                                                                                                      005a7ed8ce17e9dff274104069d9495b8e50d912

                                                                                                      SHA256

                                                                                                      801d819fc0c48f171d47b033af2e9cb57b11069537ec25fafe7da96cff42777a

                                                                                                      SHA512

                                                                                                      df8dc87602845d01d2fcd756fc6bcbbe434f95bc91166850ee47080991058cc1e41d5b193743772d11cc72789636fdb2259c448811d06d4a8f25e319b17c5cbf

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                      Filesize

                                                                                                      82B

                                                                                                      MD5

                                                                                                      301936329b743477a21431b85f4370b8

                                                                                                      SHA1

                                                                                                      1e2d48b83d765001ba01fc8a0d288a242d2cb671

                                                                                                      SHA256

                                                                                                      98345fdf3bf6f95d226faf1e3606e1230f5d358933db58e010beaf8311c802ce

                                                                                                      SHA512

                                                                                                      d74f1409e39b07e64e158c171d80f581715e955f1187126493df37590187d358aad92b439b6e0dc125d01e9eaa641a707796e4c4f709cce5c393cb9608f0bb36

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\56639cc2-011b-4daa-9708-142190c99856\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      b6c849e9962dbaa935e6917eab0937b5

                                                                                                      SHA1

                                                                                                      4c0b1bca814a0739d72a14786382825a88a624cd

                                                                                                      SHA256

                                                                                                      4517cae3e0bfa616637c2fb04f6928f2cb040972dfd7a0405b24d5bbe52069ad

                                                                                                      SHA512

                                                                                                      3eb2afea7f8ae7b6fd4be3c45b4795d910c0459bb0be4d5a06d6b64d496123cab9003969a64771c0761e5ee44d7838f95f18241ce2e301fb01ef30c6e6485f16

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\56639cc2-011b-4daa-9708-142190c99856\index-dir\the-real-index~RFe58a0a0.TMP

                                                                                                      Filesize

                                                                                                      48B

                                                                                                      MD5

                                                                                                      35f3a849c9bb6c27b549941205b5bffb

                                                                                                      SHA1

                                                                                                      a492c83fee86d4028d987be73b853fb35e0ecaa2

                                                                                                      SHA256

                                                                                                      98b9a11e5f67fb512e345d3ca936fa33aca2046449c44c1c1240ead7d2fe4f4f

                                                                                                      SHA512

                                                                                                      1dfded31455c6dec6e041f2223875ede087bb7fc9ca229524b91ea5e330febb3aaee1490b6e3a669dff20a071233fedbbd6775171a63cb4c36dbc9a8ce934a19

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                      Filesize

                                                                                                      83B

                                                                                                      MD5

                                                                                                      f182593d2043d0d93911a4e1f514d5e6

                                                                                                      SHA1

                                                                                                      120b9c3b46081ac276ac7dc73e1ec7fc40db0101

                                                                                                      SHA256

                                                                                                      8dc6f1b09f147d07ba06c21c1c020726661f1fc86ed0d9b9848c9784c8acf969

                                                                                                      SHA512

                                                                                                      1c320c00186fd0039e9778b4b7b4dccf3289c2ccc6fd52ef670a8b09dc3e5efc7d5fea9bae85903f220fb14ad51fa50c99e7733a731817bbc672a46eaf064241

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                      Filesize

                                                                                                      79B

                                                                                                      MD5

                                                                                                      27a64b50c38964d19f944b04d9015cb6

                                                                                                      SHA1

                                                                                                      1be1954dd802d158c3d1277a2967b6f8a5fb7f41

                                                                                                      SHA256

                                                                                                      ce2c35a27415c0af04cf173e3bb9194a1150d88958179f3fd8504ad29d26cfa9

                                                                                                      SHA512

                                                                                                      839fd72f164fa29e5a3d32c453e5dab1d339a4befe55c7bda051d6eb77eb414c5ef675cdfc7165566323abc8080f4d28ea0560c54a7170f274aa892164fd1ece

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                      SHA1

                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                      SHA256

                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                      SHA512

                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      120B

                                                                                                      MD5

                                                                                                      02bb545438dd4321fe8fe06c78ff67b4

                                                                                                      SHA1

                                                                                                      7b5f4df256874f91243ad7a9e1cdc976315180ce

                                                                                                      SHA256

                                                                                                      d16030d0d026b2de3b33a511ad5a0423c1048de33049e56630bf475d2cb62f88

                                                                                                      SHA512

                                                                                                      2584e4306e441cadae9e91b1eff559af7774465cdfe1f2c8311f6a98112b58e2fbf3d8a1e1b87c54908c6c2caa2cd02532d273bd10938616c91e6dba1b2c8da4

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586e07.TMP

                                                                                                      Filesize

                                                                                                      48B

                                                                                                      MD5

                                                                                                      ce62cf85a9e327a6d8eff40e2c0c6302

                                                                                                      SHA1

                                                                                                      3f92a5e4902d0acec2a5c242491d32119d129ec7

                                                                                                      SHA256

                                                                                                      a6f88a4fc1d42f6eb65e4dfaea20b0e6adb348fcc67becf01c15e0561870213a

                                                                                                      SHA512

                                                                                                      dbc13bd68950f55ecc897f1273e25655e01bcd6f2bd5c52911882a8e49902007c4c010dbd8d5f19b3072e4801016a4ea9c1b334b0ed6e8915b6233dcdd09f4a8

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      b35bda57d03427c0f4bef0f87841c49d

                                                                                                      SHA1

                                                                                                      ea38beb19d44899b5bbc6548064b1dd59d1a39a0

                                                                                                      SHA256

                                                                                                      a469c8dfcdbf0622fe8fdb185e5ac22bd79778ddcf0deb266e627b0e0e1ec868

                                                                                                      SHA512

                                                                                                      ce4915d7c54140097ba0c848c948d18a91e997ee16ce061980dfe26119894f81c34c1ff99ea0c6f9a20f8bd03a453d9cc89a3eb06ac9b781c20a94ba848d9699

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      91c1ccb383750532b145987fe5fa1a49

                                                                                                      SHA1

                                                                                                      7801ea66e994abb3e0936a0a71e7132e8d8f60cf

                                                                                                      SHA256

                                                                                                      c35eaa02e17c7589436e191d4ad94e1644654a25865b3125517570fa17cb1b13

                                                                                                      SHA512

                                                                                                      dcc727a867860e7971c011f416d8a7344a9c4773e4f70c877c09c00c562a90de1e2709298f44b237b2c0fea14b6359c08a0231b6e870bb621fee23f61658e227

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      be51fa8e0f9e3a16e76f37ae3df5bd69

                                                                                                      SHA1

                                                                                                      a8da1f3cf0a10640f1044282406c086665e8d4df

                                                                                                      SHA256

                                                                                                      3651577ab6c2882f510f9fccb3f91cdba8ed294b917ce476aa2889f4f7973014

                                                                                                      SHA512

                                                                                                      df7c4f21bba8c71774ad16cfd8a5e2cb99e9cbd361fc16d24eae62ce3684abae7f93e12cc782ddcc50fe443dd480e1573da25d6f5a708a563eceafce6492b825

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      57b14a262f314574eaed4947006e75c6

                                                                                                      SHA1

                                                                                                      7ac2198dec4674df840a008bc35d92e2ea12ab49

                                                                                                      SHA256

                                                                                                      c63d96f020efc43c151b81412ad032156f4a8a4164280b23172902a85c9a71f9

                                                                                                      SHA512

                                                                                                      c466aacc41ee4a8a1de2403372576691aed8241986a10e4da7f86014ae392007c5c76cdb34962845e630711da8d3de7c3167380ce3f0964bcb927e4daf624506

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e9e3.TMP

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      feffc1fff09ec7eb4566732679ae4d6d

                                                                                                      SHA1

                                                                                                      e80f76cb3ad699debc5f1bfb60a29947bc1cacf8

                                                                                                      SHA256

                                                                                                      f2453bf3a760a1f3474ae030aec7fff93cf5c68d7859bfa085541d1bc70a38ea

                                                                                                      SHA512

                                                                                                      8e9dd580e9ee1c2d81bb19f251fc10d3c179ab30174faf89507114c4c3b125e516c83e1d1f427a26bc2d3cf1a853445bb1b28518e24d0c97e413ccc83f88f0c0

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                      SHA1

                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                      SHA256

                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                      SHA512

                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      9e2da375e6b5a8db561187086389f8bb

                                                                                                      SHA1

                                                                                                      ef8a037ce0273e722f1e84358675103145c217f3

                                                                                                      SHA256

                                                                                                      27e629aaaa29547a7e6dd622dd56de69eb17fc6d5a3b71d5d3dc14244fd3be80

                                                                                                      SHA512

                                                                                                      d0c69ac235030034843ac743bc62af2b95ccfb88c4079fa982657661df7a287106482aaed0ffc0b9ba8882cbeca79815d3832db0ca55b47b7e3a670be862fdda

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      f2afd91270c38873c6c0b51736e94ebd

                                                                                                      SHA1

                                                                                                      5a8f9affbb3fef00d2ca89208d51432c627446b5

                                                                                                      SHA256

                                                                                                      ae168a00d486963e177a9da4b855ac209ed919c4611587e9bf77495fa08d48d5

                                                                                                      SHA512

                                                                                                      debf43612e50c112d462d450f2e24cc2c24ce4410a2f32765e32562fb132788fe39be9b7d91820962712de05aa22eac2708f45604ccfc63c8505b53aa0fdddb2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      bad4627582816d45c40c1bf3caecc90e

                                                                                                      SHA1

                                                                                                      ff0c16bc68e24279c9b3be9a2d543b656ff96064

                                                                                                      SHA256

                                                                                                      dafb15fced6e08ff2a3c796129ce88b346c50c490fb50f6d3e0b783946260114

                                                                                                      SHA512

                                                                                                      7e1b80e64aa58a8037cae715bbb35b3992ce8395a2bff61bb057faf8b761f196acdd64d8a8988ab4753120ee53a5c7fdfb56df01c3f87e82f254894642e7779b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      b09f23195b0222d94a2e4ccee7959e75

                                                                                                      SHA1

                                                                                                      b4487d7cc9f3c04d746abd5683c101fa03866ff8

                                                                                                      SHA256

                                                                                                      b621168bdcfa14535c0742ec9c98f8fd7a12f10993cb2eeee7c432d770a5b494

                                                                                                      SHA512

                                                                                                      36e03a0eabe4aedd4a9ae1981cba4348223860268f3b1abf1df1edad54b072968ef57615e94da7b08a86965ae983054765ea1f702367a26f6b492557bcda361b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      908627c5f1d21d593f9de6ce8410d4cf

                                                                                                      SHA1

                                                                                                      94fd875a087183a335e7a3fbd62de8ead5275afd

                                                                                                      SHA256

                                                                                                      e8168dc57ced40e7133e69ea4ddf6b108b95dca2640a50c84fa78f0f7d359645

                                                                                                      SHA512

                                                                                                      9605e8009ef293ebe69ed8eacffd315d29bc9d68188025cda35a4815cce151e0c548a2b0601033cfce5497f7a0b39eb87288c1a8f3a8dae6f08b3bde1f79087b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      1475a476f2a7eaf27c3de5154822a193

                                                                                                      SHA1

                                                                                                      c5072e25e6ea1678a1a0eb70ccdcafd72fabe5f5

                                                                                                      SHA256

                                                                                                      56dec4428bfae34e824047c27e268e7e3b3709b7aeb7c1d2b7aa5ea7b8bd21a9

                                                                                                      SHA512

                                                                                                      1ec25b826e34a7a56c47a89bc8202a56c5b344eea5a41a20e1c11dfdf8bbd4843079a69296640e55eae96a9d77f08189d32e8d495b2bd09383436a9bdf4d33e7

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      ac74c3f04598216308fa6732c8d3675e

                                                                                                      SHA1

                                                                                                      4b15adef835b76f5d3ba8b688e60252469768af6

                                                                                                      SHA256

                                                                                                      0ecb68734097934d05215e554d6ae400db17e417d606b9163812d39fba1c9717

                                                                                                      SHA512

                                                                                                      39c3597c18fbfb380e1bcab67d83022bf478879d3b645bbb2d59cfb762cdf5428050b9ec0c09b5270c92dfc6fd57d47ea64b34405f517c3ee3ee405d9d33e5f5

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yP0ee34.exe

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      9c09638591b6196b51e8894f0b6ef625

                                                                                                      SHA1

                                                                                                      1e0dc9f98d1b0153c88589de7df7e740544543a0

                                                                                                      SHA256

                                                                                                      8ef66a41bb455f5db1b2e07d724faabba828eada908b4b62974a530cacd9e6e1

                                                                                                      SHA512

                                                                                                      6161333bc677048588e20c7da4ddcfbfb542349cfe9f3ce193af4f4e5ed1c388efc02d1e0ed64777b0da8050c45f118faeea7ac8582f9b14c97882e4174b43e5

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1mI35my5.exe

                                                                                                      Filesize

                                                                                                      898KB

                                                                                                      MD5

                                                                                                      d051d1e89e929bbcf166621dc8e7452a

                                                                                                      SHA1

                                                                                                      16c5334d016b554b6cd9e91912276521b53a3eec

                                                                                                      SHA256

                                                                                                      b7b3a02ff58d57ba9c2523c5e2f64c1523792c78ae4f68bbab663516e490157e

                                                                                                      SHA512

                                                                                                      e121a1d4ec621ca005f83626ba3b9758a7cee8e14f15f3613d645d04b7e3e08eb6cfbf2bf4cee8c85e6dba88135eda54fb24e35b139daff3d5a308dd76c288a4

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Na7881.exe

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      MD5

                                                                                                      f8e7488fd4ced59d6eb387447bc37430

                                                                                                      SHA1

                                                                                                      560ed0a592273875ae66a93efd611f76a9da7ee7

                                                                                                      SHA256

                                                                                                      30d11b5bd1ed2f376bb2c6dd47299a54702bf9cfdfc0d32e5f50c1adf83ae347

                                                                                                      SHA512

                                                                                                      0e7445eb71a24e10c13a706189cc972d9d590bbd456f27b4008243161868fc6b0e86fd8fadf42f61502aa913f39e2a3fedb7de236b80a2bff05378b7ade6cdb2

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\grandUIA2b953_Mzw7tDW\information.txt

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      272a26f40f8103818bfe64f35d0385d2

                                                                                                      SHA1

                                                                                                      28d19db8486d4b6c5e64cf16cc40e2e58d6531ff

                                                                                                      SHA256

                                                                                                      f25c899be090faebe0a4f1e7b97e3b33a3f38ac9387f1df0a3f446e90bfc94a1

                                                                                                      SHA512

                                                                                                      5137ce9e8ea95954099e9b72c245e2724d9645854001da6dae28ad962857003828d8edf02a160c118e2e9d8adfb03dc4f08fe5976765a6121439e25811dc29a0

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\posterBox2b953_Mzw7tDW\QdX9ITDLyCRBWeb Data

                                                                                                      Filesize

                                                                                                      92KB

                                                                                                      MD5

                                                                                                      250f6cee6a8be4a85cd0d78b8f9ac854

                                                                                                      SHA1

                                                                                                      48a5be711abe88c0efb7204f6c792e67a99d390a

                                                                                                      SHA256

                                                                                                      21e090219937792f360789c94785cf969cf22fb9e2ae145dec419dc4beab1321

                                                                                                      SHA512

                                                                                                      4685c2cbc34566879e5c494f1433996ce9541e048a87036876d0ec426a02a13af6ed606575306522def4dd19a3fcc34b95335f492b21960b28e8f12be82a35b7

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\posterBox2b953_Mzw7tDW\ZunTSaNJLBVfWeb Data

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                      MD5

                                                                                                      f70aa3fa04f0536280f872ad17973c3d

                                                                                                      SHA1

                                                                                                      50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                      SHA256

                                                                                                      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                      SHA512

                                                                                                      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                    • memory/8304-630-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.6MB

                                                                                                    • memory/8304-542-0x0000000000970000-0x0000000000A70000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/8304-631-0x0000000002670000-0x00000000026EC000-memory.dmp

                                                                                                      Filesize

                                                                                                      496KB

                                                                                                    • memory/8304-543-0x0000000002670000-0x00000000026EC000-memory.dmp

                                                                                                      Filesize

                                                                                                      496KB

                                                                                                    • memory/8304-559-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.6MB