Analysis

  • max time kernel
    70s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 06:32

General

  • Target

    f791092308977c396cb05e54cad40ffb.exe

  • Size

    1.6MB

  • MD5

    f791092308977c396cb05e54cad40ffb

  • SHA1

    490d762bd217986dce936f1dcfaf845cb141c7ee

  • SHA256

    aa6109131f311c7ec4cbd993ac6fb997dda5beefee5863895e36608288fcac8a

  • SHA512

    a100c4fc00b55b727eaf618c4a2c9b2e958e2b7accb790e7c431d852207e0e1e99944decec64ce605290337b2d5bf73931765854b09442693b02807a2b3e78be

  • SSDEEP

    49152:I6ae5enbOM+/6dTW+i54t3LisOpDeWIKm59kHW:/aUep+ypmsOpDeWIKmc

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f791092308977c396cb05e54cad40ffb.exe
    "C:\Users\Admin\AppData\Local\Temp\f791092308977c396cb05e54cad40ffb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4340
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3748
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
              6⤵
                PID:2600
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6583747908476305771,4786690574386680291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:5744
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6583747908476305771,4786690574386680291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                6⤵
                  PID:5668
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                  6⤵
                    PID:4568
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5736
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                    6⤵
                      PID:5728
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
                      6⤵
                        PID:6024
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                        6⤵
                          PID:6400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                          6⤵
                            PID:6392
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
                            6⤵
                              PID:5628
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
                              6⤵
                                PID:6652
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
                                6⤵
                                  PID:7144
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                                  6⤵
                                    PID:7152
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                    6⤵
                                      PID:6108
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                                      6⤵
                                        PID:7136
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
                                        6⤵
                                          PID:7244
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                                          6⤵
                                            PID:7332
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
                                            6⤵
                                              PID:7628
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
                                              6⤵
                                                PID:7656
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
                                                6⤵
                                                  PID:7976
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
                                                  6⤵
                                                    PID:6408
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                                    6⤵
                                                      PID:6640
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7288 /prefetch:8
                                                      6⤵
                                                        PID:6712
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7288 /prefetch:8
                                                        6⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:6044
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
                                                        6⤵
                                                          PID:7564
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
                                                          6⤵
                                                            PID:4648
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
                                                            6⤵
                                                              PID:7920
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7872 /prefetch:8
                                                              6⤵
                                                                PID:6236
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8032 /prefetch:8
                                                                6⤵
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:6248
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1
                                                                6⤵
                                                                  PID:5772
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
                                                                  6⤵
                                                                    PID:6580
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2044 /prefetch:8
                                                                    6⤵
                                                                      PID:7160
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3615611836874109723,1625508262293605469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
                                                                      6⤵
                                                                        PID:1600
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                                                                      5⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5096
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                        6⤵
                                                                          PID:2792
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16554537882795338233,3762795737988452244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                                                                          6⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5624
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16554537882795338233,3762795737988452244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                                                                          6⤵
                                                                            PID:5616
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                                                                          5⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:700
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                            6⤵
                                                                              PID:4020
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6197178169905563733,10832379573645297369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
                                                                              6⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5632
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6197178169905563733,10832379573645297369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
                                                                              6⤵
                                                                                PID:5600
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                                                                              5⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1840
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                                6⤵
                                                                                  PID:3904
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,16445107643402604848,18331255578903344367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
                                                                                  6⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5152
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,16445107643402604848,18331255578903344367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
                                                                                  6⤵
                                                                                    PID:6000
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                                                                  5⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2520
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                                    6⤵
                                                                                      PID:4548
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1428438439359726754,478092028846677749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                                                                                      6⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5928
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1428438439359726754,478092028846677749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                                                      6⤵
                                                                                        PID:5920
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1620
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                                        6⤵
                                                                                          PID:4272
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18364775319149402013,3654817784379715203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
                                                                                          6⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5608
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18364775319149402013,3654817784379715203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
                                                                                          6⤵
                                                                                            PID:5588
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1124
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                                            6⤵
                                                                                              PID:4892
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7173802027960363414,16698507247316578400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:6008
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7173802027960363414,16698507247316578400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                                                                                              6⤵
                                                                                                PID:5896
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                              5⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5080
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd32846f8,0x7ffcd3284708,0x7ffcd3284718
                                                                                                6⤵
                                                                                                  PID:4940
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10985533707189137013,12673709148387383204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                                                                                  6⤵
                                                                                                    PID:5992
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10985533707189137013,12673709148387383204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                                                                                    6⤵
                                                                                                      PID:5884
                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe
                                                                                                  4⤵
                                                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Windows security modification
                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2940
                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3ER52Wi.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3ER52Wi.exe
                                                                                                3⤵
                                                                                                • Drops startup file
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • outlook_office_path
                                                                                                • outlook_win_path
                                                                                                PID:6568
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                  4⤵
                                                                                                    PID:5876
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                      5⤵
                                                                                                      • Creates scheduled task(s)
                                                                                                      PID:5408
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                    4⤵
                                                                                                      PID:5648
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        5⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:5992
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                        5⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:6068
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 3084
                                                                                                      4⤵
                                                                                                      • Program crash
                                                                                                      PID:5692
                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Xa6aF0.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Xa6aF0.exe
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks SCSI registry key(s)
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  PID:5696
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:6564
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:5284
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:6564
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6568 -ip 6568
                                                                                                      1⤵
                                                                                                        PID:8184
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BA62.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\BA62.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4668
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BE4B.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\BE4B.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6220
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C34D.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\C34D.exe
                                                                                                        1⤵
                                                                                                          PID:1712

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76636dc8-de75-49ba-a07a-551de2effe08.tmp

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          8ba7e07d2e1cdad3ac6add27e27598e9

                                                                                                          SHA1

                                                                                                          140af338c3bd2cba6cd8ca16e76bdc4a05eb16af

                                                                                                          SHA256

                                                                                                          141103e616c3783bc888107cd0168f3e3b29683f53b98f07dda7ce46c9f30279

                                                                                                          SHA512

                                                                                                          0475f97470a4a03b5701c5a0207d338ede61d24ab5894325ae9654ad8ef2da6a252cc55d5430e9db6a91cd912b5274d775d25088063c04f2cb47d9404e8e4ede

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                          SHA1

                                                                                                          8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                          SHA256

                                                                                                          d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                          SHA512

                                                                                                          6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          efc9c7501d0a6db520763baad1e05ce8

                                                                                                          SHA1

                                                                                                          60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                          SHA256

                                                                                                          7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                          SHA512

                                                                                                          bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\080d1aa9-6573-48b1-8192-1630b8347fbd.tmp

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          5a5f3dd1585642b2f33dcfa44cc412b0

                                                                                                          SHA1

                                                                                                          08c5893cd0c78dee044eb40161e127e3c3e2a177

                                                                                                          SHA256

                                                                                                          e43bfe7ca220041a30f29f0b53c4efbcbb29a0a745781d03dec0b2036ba8a68d

                                                                                                          SHA512

                                                                                                          adda4d5ae5c699a9fd0512319fceaea4ae9b02fb611b6659d23f3d5cfdde977b759acb1e02024498a1a28faed70ca455020ccdd07dd329e5d5ca0c58b53d1850

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41f302c8-ce06-4e13-aeec-589e578921f2.tmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                          MD5

                                                                                                          129fbdf720fd8847bde8b2d718182041

                                                                                                          SHA1

                                                                                                          4f7dd78a5cc6e70057e1381aa38aa79f8694117e

                                                                                                          SHA256

                                                                                                          23453dcbcba82e26e6214258c8e7e33624bf6dc128a0f52d04df9f9e8680fcab

                                                                                                          SHA512

                                                                                                          39d24102ed5d831d7c7c2524e6b9ab73abde195ee6d9e5bf2a6129d234aa064c2400671a5f28568d225ce112e399aa9dd753a0cce261218379a8b01f702f0f6a

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70449631-8fa1-4e25-9da8-56a29a90af56.tmp

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          ceb4088a3aaf80c8a5c0986dfcfca209

                                                                                                          SHA1

                                                                                                          86e20daf87be90fe8c5c9612c595a7eb6dd0dad0

                                                                                                          SHA256

                                                                                                          d317fc8f3585d3fb97636959960841d5c3a1930f039b587494d3c474f2d45bd2

                                                                                                          SHA512

                                                                                                          406408821aa30d10a75868adf01573952b17d07f8a7df3369b535e59bc429f0571781f82e808234a01dd899f60e3f5a2dd2e11348c857cd85fd2abc8225ad306

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

                                                                                                          Filesize

                                                                                                          201KB

                                                                                                          MD5

                                                                                                          e3038f6bc551682771347013cf7e4e4f

                                                                                                          SHA1

                                                                                                          f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                          SHA256

                                                                                                          6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                          SHA512

                                                                                                          4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT

                                                                                                          Filesize

                                                                                                          16B

                                                                                                          MD5

                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                          SHA1

                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                          SHA256

                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                          SHA512

                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                          Filesize

                                                                                                          396B

                                                                                                          MD5

                                                                                                          cb1887c4e26172e1350feb037ed7cc48

                                                                                                          SHA1

                                                                                                          77b92849c515af6d89a0b2b54148a9c2d801e9f4

                                                                                                          SHA256

                                                                                                          ac341a6fe07b490a16cbf226cea9be55b8b4aa5682987bfce2a1165644052db0

                                                                                                          SHA512

                                                                                                          8d8c0fb04354951d80d51965781f81bd954aa21e487380e7baf53c127bd4afccb62d151ef8a9701964a170992c13355b1134a075abb61acc8dbd92ea15d9d16f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                          Filesize

                                                                                                          396B

                                                                                                          MD5

                                                                                                          1f7d3ab918474d0de856f2ee02526165

                                                                                                          SHA1

                                                                                                          3da8ff258d861733d22b624a0d78c7da168a9298

                                                                                                          SHA256

                                                                                                          0097d8660955d7d7dc82e51ee5724d74f311ff86d9975dbccd7c95dd1277c9f2

                                                                                                          SHA512

                                                                                                          04bf7b3fae7fe4c4650321a376125588d7399cbaef1f1adfa521a13015116bf0ea02ee79b09b75f1566017003ea68afbc877120e2e3f30312e3f4dcfa3acbb08

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                          Filesize

                                                                                                          393B

                                                                                                          MD5

                                                                                                          6f9c7b329aa6270fcbf4298047221d70

                                                                                                          SHA1

                                                                                                          93fa1869a9c9dcba0c77da348532628323af8c6a

                                                                                                          SHA256

                                                                                                          d9ab84abecf54042289eb8885f9576ad8668998c0a83287d30a65fb9dfa47c46

                                                                                                          SHA512

                                                                                                          9fd2b58a0cccc9cc9213b710181a4dd16134b65c9f25c38004dcf9caa79fb6455cb1f09f16b48792e6abe45ef0243de04fee82d7f4415b0ca4a8771ed67e597f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                          Filesize

                                                                                                          393B

                                                                                                          MD5

                                                                                                          44d40f77ce1c1d35c991c41dbded878d

                                                                                                          SHA1

                                                                                                          1c277843b9d47ecb943e32bf231eaabe9e160c57

                                                                                                          SHA256

                                                                                                          654f7c53664d44c5869aaa8b24c555fce096edffc41a689fb8975543d5b8a76e

                                                                                                          SHA512

                                                                                                          2ed5e8ae31fbb1016dbcfe2e19adb897a0db3e50a8ef060914ea25e6bf8c24e1dfb932757b3de070c67b20db2e7315d9acc92aa30ee15428e7571ec489e7433f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe588865.TMP

                                                                                                          Filesize

                                                                                                          353B

                                                                                                          MD5

                                                                                                          39920091084b8d30bc17b32724ba4ef8

                                                                                                          SHA1

                                                                                                          6ecca8a2a2fa10532a480edde4b447bf91ea821f

                                                                                                          SHA256

                                                                                                          a79f12d3b82632cb54ff9645a7607adbaf32addf02b37f9a4e9382a520bea707

                                                                                                          SHA512

                                                                                                          3edbedc841ccfd59b078b38be577c531a78b46465ef59e4640fc19175fe960041a37557bebd3c1ccfd8a3c3d616b2c42d67ab7e0a79c06bd179b9cf1675b8027

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                          Filesize

                                                                                                          23B

                                                                                                          MD5

                                                                                                          3fd11ff447c1ee23538dc4d9724427a3

                                                                                                          SHA1

                                                                                                          1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                          SHA256

                                                                                                          720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                          SHA512

                                                                                                          10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                          Filesize

                                                                                                          111B

                                                                                                          MD5

                                                                                                          285252a2f6327d41eab203dc2f402c67

                                                                                                          SHA1

                                                                                                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                          SHA256

                                                                                                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                          SHA512

                                                                                                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                          MD5

                                                                                                          3a8d7d508ad9c33930bfcbadd84b970f

                                                                                                          SHA1

                                                                                                          b365fce061a991a8581a744b8515e9a233523206

                                                                                                          SHA256

                                                                                                          270b7730287cf9971c280dc3bb71501454327a2eee521c939f11a6549821841e

                                                                                                          SHA512

                                                                                                          1cf00a2473fc130906f86788927f14e82999280cc9acb5c1cfb616123059eada8b5497805aad11426e4013fadec42fa24c9432214192dbad3cb8e24881097b54

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          121510c1483c9de9fdb590c20526ec0a

                                                                                                          SHA1

                                                                                                          96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                          SHA256

                                                                                                          cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                          SHA512

                                                                                                          b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                          Filesize

                                                                                                          89B

                                                                                                          MD5

                                                                                                          9d1eb4e2e410cf7b2da40949e7d86d9b

                                                                                                          SHA1

                                                                                                          e4cb33e3691d0700641559324803cc96461cdc5a

                                                                                                          SHA256

                                                                                                          b8fb66f517681d6563e74cdf9b81527aed0f63cb044acb74a32a7d9f0de5644a

                                                                                                          SHA512

                                                                                                          7b57bf0cedc9148daed68906896abc7abe5dac26da69a0bced59a6a1b5d37bbf4b48d79513492149fee13a40118f91309e9bf729f1d97c541193e4e467c52e6f

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                          Filesize

                                                                                                          146B

                                                                                                          MD5

                                                                                                          a903e85b700f856fd13c9819fbac95dc

                                                                                                          SHA1

                                                                                                          360d3464abd9d63a7bc817744983ca557c6be0ca

                                                                                                          SHA256

                                                                                                          52ab6b10269224ae4bec2aebef7d1b01b82b057ed01fc9b073e357f0c6e4f8c4

                                                                                                          SHA512

                                                                                                          c9eed86e0bc0cecef6240c6a683cdb6a38a8616fc2dae24019bfe8d8d4bd978c462dbaff6ff7e75bd83d190dc4ff25dc82d8ef866767dd707fa9db0b8a04b8cc

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                          Filesize

                                                                                                          82B

                                                                                                          MD5

                                                                                                          52115b6e61be0750530ebc5936cbe91e

                                                                                                          SHA1

                                                                                                          8f544c623de1cdef9fd8cab58804761c96b5fdcd

                                                                                                          SHA256

                                                                                                          527e5ce5c07405e4e18e924bd9d9a647e1af5670eb81a4df469c943de7307d52

                                                                                                          SHA512

                                                                                                          2c987d2f3cd15c4418873f8fce2398bd33411c93312f86124e1f801bb370b3a1c99d3c7c0a799fbe258cf830d3d508194c39eb3902c2bcd0832441a303437015

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                          Filesize

                                                                                                          83B

                                                                                                          MD5

                                                                                                          d9e3ec263c2f938b7252cf9a44e6761c

                                                                                                          SHA1

                                                                                                          b0100c077bb0f56115cfe1cdb9f4024acc3a6b6b

                                                                                                          SHA256

                                                                                                          4c976da778074d23a814bdfb1cd6fd6595f3d970f6c82cc5878d526c789b467a

                                                                                                          SHA512

                                                                                                          485a3b7d6e220ef2779e734458436abd6a88097d0b700ef2b38ba9388cc33e3dd168ee38732eacafe44b17f60b479a59d1b7f0537cd23c7874c073633df9f50e

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          5e0abcd715da9bfa2c7783cb374b68f8

                                                                                                          SHA1

                                                                                                          cd662cfc020fd71f29a5832d2266414d47924dcb

                                                                                                          SHA256

                                                                                                          ed7c51c5e65209e487004cc1aacd34017e7bec54638360c2fc758c74200620c7

                                                                                                          SHA512

                                                                                                          86a66557368161a40a24e171e30b43e7fb0f58112673dd237f8f932c807da44dad7e82e04bbd311d95b471bb7e416cfabdc4a25dedca4e8781fe1271462c705b

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          MD5

                                                                                                          73142b5d3990cd9333e6eceadda859ac

                                                                                                          SHA1

                                                                                                          6886bf3e9da96dd6dd42ec6051d4e0f82b423750

                                                                                                          SHA256

                                                                                                          ccaf6d4a7c93a10f7d16856ad7b1f32d63e637d8d2cbeb283ac3f66d240240ea

                                                                                                          SHA512

                                                                                                          96ea346e973414dcbedcd0161121df16bbca6eb2ed071955ea59fedd0cc34640d3ae3968f05ae935b5b798d4a0e211895252292c00bfddd2a8cb011997cfdc88

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          cd9d9939998ba219685f0a4c16e88133

                                                                                                          SHA1

                                                                                                          09b1f7d2e4f4676d6defcd6160581b244511c6b2

                                                                                                          SHA256

                                                                                                          69f4df6fcf84ef75869c95718f5291f1fa4ed092ba14cd485a4909b016114ee9

                                                                                                          SHA512

                                                                                                          de48f1c128d36ddccfbfb3630aba84f6f54e219ac4cd7ea71874d928dd3c4a50fba479ba3db293a4011ca41915ff0ba207caf6e70c52bfdd117962c5022d0f62

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583a26.TMP

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          f86f6d50d1e16e1cc9149d608d9c2288

                                                                                                          SHA1

                                                                                                          ec5dcbd2dbb9388b1dfcea2093f48e6eef844f34

                                                                                                          SHA256

                                                                                                          227d7b2cdd31cd9cf932d120d29b14d2efd095502273fe80763d2348694e226a

                                                                                                          SHA512

                                                                                                          cb117076b28d1b490938950f5d4d99a0283b92210230c6c2b26e0e629dfc1023ecba9310d61eb192c7e1b3f2cf74989ae0c948adbd673a6ad62a1a76192e0884

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                          Filesize

                                                                                                          16B

                                                                                                          MD5

                                                                                                          6752a1d65b201c13b62ea44016eb221f

                                                                                                          SHA1

                                                                                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                          SHA256

                                                                                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                          SHA512

                                                                                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          0ca62978d4c4707a1af1976338c49ef8

                                                                                                          SHA1

                                                                                                          c849731da1808949f915f64138cae16c8165f4ef

                                                                                                          SHA256

                                                                                                          eac82f2f64c06c79c6d5245efe3f576fc233077682822883cb79de5475e25375

                                                                                                          SHA512

                                                                                                          69ae596d2a9d2623d67104f037e49933620dfedbd0fd273d94426efbcbfe5739bd6ab6ddb7150397e53415171115a3aee5a0b2a215d2bfd770b250a82c94b069

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          b938015331bbaacf1f0b8eedd2aeb205

                                                                                                          SHA1

                                                                                                          4f4910c80589568d9ccb93e61002e6c25a805af0

                                                                                                          SHA256

                                                                                                          8e501a01cc88c457d250195d258e1539bbef0d310002e2e6b3d989c4b4122598

                                                                                                          SHA512

                                                                                                          233fabf0e6758a8d9d701968897a0364811e2c6046bbf690772b65aa6c89d0d870e2fb9fed6cc7a0b43ea67a96281583e0ecb0c3af1cf1b34abb5048d6b325dd

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          b0ca25ffe43588f5f3748d726de370c1

                                                                                                          SHA1

                                                                                                          80e6e08e6a9f016695b6e43cf3bd39d108801b0b

                                                                                                          SHA256

                                                                                                          095a0a8f2a93354045ed5dc60ee3ac308dad9136bcb5001e71179e84bbb22a60

                                                                                                          SHA512

                                                                                                          b34ceb4d2f43b724aa1d9317fc1e7bdb283ea162cdff9f4dc0c627d209444517e0db290a44282545feeb214efa4314e264e1e5e392ff6db3f63905a8b0042f65

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          5f31a693512f77c9779c6bb73f33a6b3

                                                                                                          SHA1

                                                                                                          b2e235179f8cb21f2156c686ffb772f14049f3ac

                                                                                                          SHA256

                                                                                                          98e41d6e6a850ad223f3408b02814678039d0264335211d796b6ab6b9ef2659f

                                                                                                          SHA512

                                                                                                          7b105d1324f564b0eb9f77dafafba8dc704c5703b95b71b7353dcb9603ac0c2936331e2ff32d45afc034b96263da84416debb83212a0afe8063b7551dec58a49

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          5017e6747a927115cad1753447cb3364

                                                                                                          SHA1

                                                                                                          ccdc2ddbc5304f1feeb3b6c7b65f36e5a97bf98f

                                                                                                          SHA256

                                                                                                          5e5622095cc624b0fd3c1caf536d85aa65da0201426bee9d89acc987e3dc1b84

                                                                                                          SHA512

                                                                                                          85f6934cd8dbec85e3ec4dcacb5a2a3c526556bdede65c2bc48cbe4372699391032f5a5dd39813c3b5301ab93e65e9289f94e1c48dae373c661daf2e2b4840ec

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          4f68a2c951c603472838a1f5362bc63b

                                                                                                          SHA1

                                                                                                          44880d45c0d44154a2d8ec8342b289d947ca0e44

                                                                                                          SHA256

                                                                                                          1a0e9264763b91ca6335bcdb46542d279b22868830ce02f1437d8d86346bcadd

                                                                                                          SHA512

                                                                                                          ff0f9ceb77b99fca49745cc6461bd30f2bae373449407a601680cff0df3ba8ae449d9b3248e2250fe5af365549aa68bddbbdb7d897aaf3961a5dfb69b4021172

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          3cacaea03e1fe4f45a6a997c99855d76

                                                                                                          SHA1

                                                                                                          9854d93362ee226461d33e46a877331f40c465c7

                                                                                                          SHA256

                                                                                                          95a3dfbf77e857674ab6fb3d17e09eefd9f0231cce942ecb06a285e0cbfa3bbd

                                                                                                          SHA512

                                                                                                          3b2031e123ab5230b87048476cf53b3d3b2b14c68e5b4f79bd13c40216d5922e75d6db8da44d507da18b7163a604807165e1fb5d169571289eae28aa2114a357

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0970b88-d523-4709-922f-f8c7f025751c.tmp

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          7e8d67bd416fad4526fa3daae762b9ef

                                                                                                          SHA1

                                                                                                          523e584fa0fed4cabcd7ca9b26d26d93c5502892

                                                                                                          SHA256

                                                                                                          7bf660058d2e4d636dbd94f6776f7d3e1cc515008f0293f30ede538127ba8fdd

                                                                                                          SHA512

                                                                                                          2315c75504d967dcd7fb7c22d2a1a7643b014df8f92fa1eb168a9c3ac377a280fb4b25610d563c47af832c34ad95692232f976740c911373b6e93fb8bc268f20

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                          Filesize

                                                                                                          802KB

                                                                                                          MD5

                                                                                                          4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                          SHA1

                                                                                                          14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                          SHA256

                                                                                                          25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                          SHA512

                                                                                                          c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ra8da15.exe

                                                                                                          Filesize

                                                                                                          1.5MB

                                                                                                          MD5

                                                                                                          a77cc3a09762cd0c5ff1665efd071481

                                                                                                          SHA1

                                                                                                          56841bf775833ea7710ea330d6246c0a8737bea2

                                                                                                          SHA256

                                                                                                          c479b550f4022a1dd60ea0d0f41af3509f61a4a661080df6992d5f2d41e3693c

                                                                                                          SHA512

                                                                                                          63a690d6659f0a833c31e725e1122769db267caac11c2b82d0cf7b320711bd5641658f2fc8b5ca3af775abc222f54a641687fbc230ec4bacadf8d98cd3dd0233

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          b8a124c3b6b43ad8a19cfb74e241f8bc

                                                                                                          SHA1

                                                                                                          81726c8e41f6b877ec159eae5a42c26fb213156e

                                                                                                          SHA256

                                                                                                          d5e6ad8d48e4150f9516552c8de4726e5676c784bf4c81501fa96a1426fc5da3

                                                                                                          SHA512

                                                                                                          84e3043a88fe43900aa9bfe2fd467b5e6d9d45639e381aa262e1621240e6c086230c66a8bf54aed4c4398cdc70f9d48a52f345c0789fba1e46237d221afa5996

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EF6iA85.exe

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          f65510e4e22bf941166ed037c30d73da

                                                                                                          SHA1

                                                                                                          6f870d9120294e6b6ea349e41322eadb498035c5

                                                                                                          SHA256

                                                                                                          fa893242a5e1cf3419890017a6bda3c3490d58080b40b8d0e49f74cc2adcf473

                                                                                                          SHA512

                                                                                                          c6ed075369b42a6d4bbcc9881e9b730bbc450073cd810e3d39a7f47541299c6f45205461a34b2e4b420c5a774fc965ea691f898030301f982b98fa1bb48482c0

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ay74JK4.exe

                                                                                                          Filesize

                                                                                                          895KB

                                                                                                          MD5

                                                                                                          35b5e1f030022f1a4e7455fd5e68fd54

                                                                                                          SHA1

                                                                                                          f1dd4915925e7b25f2f0af97ca45d87f9196596c

                                                                                                          SHA256

                                                                                                          7207fcfb0f7bb9e16f376914f59b8fcab071910f787cce6a087ed8e2c5c1fe41

                                                                                                          SHA512

                                                                                                          502258f6f13fb69e26cbd663c74a69a941c0b2156e20eb462dd6d5c83cc3403cda6277f89c6825cc32f20cd69b330773d0812a7c682cbe68c869361469f563b6

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe

                                                                                                          Filesize

                                                                                                          192KB

                                                                                                          MD5

                                                                                                          9495a0b56a746dd30d974697569eb02b

                                                                                                          SHA1

                                                                                                          3ba50f9f2831222ed9201966acc34b54633762a5

                                                                                                          SHA256

                                                                                                          d2443c4e9bead92052592c95d6302dbec2a88eb297fbc89df5cbf8d65c17f7c0

                                                                                                          SHA512

                                                                                                          8ad88bb102a22691d174578bf92462ff33f6d200ae3e60aaade33a83003c8b53d9bdcf058845cb4daa3dc19c9bd4ba353941ba575097ed55e8d7ffe18993ffbb

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2vy1596.exe

                                                                                                          Filesize

                                                                                                          603KB

                                                                                                          MD5

                                                                                                          09ad33bc3340bb460945f52fc64d8104

                                                                                                          SHA1

                                                                                                          8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                          SHA256

                                                                                                          a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                          SHA512

                                                                                                          2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tempAVScdDPbtKsWWo3\Gb5Tn7WlWzXyWeb Data

                                                                                                          Filesize

                                                                                                          92KB

                                                                                                          MD5

                                                                                                          ec564f686dd52169ab5b8535e03bb579

                                                                                                          SHA1

                                                                                                          08563d6c547475d11edae5fd437f76007889275a

                                                                                                          SHA256

                                                                                                          43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                          SHA512

                                                                                                          aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tempAVScdDPbtKsWWo3\ixQffBXMSL8JWeb Data

                                                                                                          Filesize

                                                                                                          116KB

                                                                                                          MD5

                                                                                                          f70aa3fa04f0536280f872ad17973c3d

                                                                                                          SHA1

                                                                                                          50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                          SHA256

                                                                                                          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                          SHA512

                                                                                                          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                        • \??\pipe\LOCAL\crashpad_700_TBTMAZUPCUSXRPSZ

                                                                                                          MD5

                                                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                                                          SHA1

                                                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                          SHA256

                                                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                          SHA512

                                                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                        • memory/2940-127-0x00000000002F0000-0x0000000000690000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.6MB

                                                                                                        • memory/2940-604-0x00000000002F0000-0x0000000000690000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.6MB

                                                                                                        • memory/2940-280-0x00000000002F0000-0x0000000000690000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.6MB

                                                                                                        • memory/2940-274-0x00000000002F0000-0x0000000000690000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.6MB

                                                                                                        • memory/3532-919-0x0000000003250000-0x0000000003266000-memory.dmp

                                                                                                          Filesize

                                                                                                          88KB

                                                                                                        • memory/4668-1567-0x0000000000900000-0x0000000000A00000-memory.dmp

                                                                                                          Filesize

                                                                                                          1024KB

                                                                                                        • memory/4668-1571-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.6MB

                                                                                                        • memory/4668-1568-0x00000000024B0000-0x000000000252C000-memory.dmp

                                                                                                          Filesize

                                                                                                          496KB

                                                                                                        • memory/5696-925-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/5696-829-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/6220-1578-0x0000000000D20000-0x0000000000D5C000-memory.dmp

                                                                                                          Filesize

                                                                                                          240KB

                                                                                                        • memory/6220-1579-0x0000000074460000-0x0000000074C10000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                        • memory/6568-614-0x0000000074110000-0x00000000748C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                        • memory/6568-675-0x0000000008EF0000-0x0000000009244000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                        • memory/6568-734-0x00000000053D0000-0x0000000005436000-memory.dmp

                                                                                                          Filesize

                                                                                                          408KB

                                                                                                        • memory/6568-631-0x0000000007760000-0x0000000007770000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                        • memory/6568-621-0x00000000077F0000-0x0000000007866000-memory.dmp

                                                                                                          Filesize

                                                                                                          472KB

                                                                                                        • memory/6568-827-0x0000000074110000-0x00000000748C0000-memory.dmp

                                                                                                          Filesize

                                                                                                          7.7MB

                                                                                                        • memory/6568-613-0x0000000000990000-0x0000000000A5E000-memory.dmp

                                                                                                          Filesize

                                                                                                          824KB

                                                                                                        • memory/6568-674-0x0000000008A00000-0x0000000008A1E000-memory.dmp

                                                                                                          Filesize

                                                                                                          120KB