Analysis

  • max time kernel
    66s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2023 08:33

General

  • Target

    bc32916ee163d39b6e576ed8fcfa883a.exe

  • Size

    1.6MB

  • MD5

    bc32916ee163d39b6e576ed8fcfa883a

  • SHA1

    76a770c345a2cc9a0f809d4de17414f13a79a5d3

  • SHA256

    0cd714e33c9ebb3b55d89c349099a96bf4540512eac2baee479503303116e3a8

  • SHA512

    266dbfe56363aa7f8a65636dd7b2c7b1ed36b3a138ec41cbf5098d673a8d50c89cb20b5c8bd14dcaf15baf348fb718c1f52391cf9c6e2b4dc97622703f02b912

  • SSDEEP

    24576:lyUb5Mu32rFOgcouDoIkR+kxsszmNKasn045cI2Uej6IP/NEfinzDwpaD:A05Mu32rJuDEj2jN40YU6IHN7zb

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://185.215.113.68/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

lumma

C2

http://soupinterestoe.fun/api

http://dayfarrichjwclik.fun/api

http://neighborhoodfeelsa.fun/api

http://ratefacilityframw.fun/api

Signatures

  • Detect Lumma Stealer payload V4 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc32916ee163d39b6e576ed8fcfa883a.exe
    "C:\Users\Admin\AppData\Local\Temp\bc32916ee163d39b6e576ed8fcfa883a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC6pY31.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC6pY31.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mT4fC12.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mT4fC12.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3836
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cj90Bz9.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cj90Bz9.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4036
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
              6⤵
                PID:3792
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12363158872667162519,6607583783267283322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:6260
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12363158872667162519,6607583783267283322,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                6⤵
                  PID:6236
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2596
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                  6⤵
                    PID:4352
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16150112933852676775,4466047393499668782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5852
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16150112933852676775,4466047393499668782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                    6⤵
                      PID:5648
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2284
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                      6⤵
                        PID:620
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,10133279569262277003,593592884963543913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,10133279569262277003,593592884963543913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
                        6⤵
                          PID:5748
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4796
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                          6⤵
                            PID:220
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1540137378666719084,13684356599362946781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
                            6⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5512
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1540137378666719084,13684356599362946781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
                            6⤵
                              PID:5504
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
                            5⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4964
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                              6⤵
                                PID:2004
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10157074287982256017,9785364673385588963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6284
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10157074287982256017,9785364673385588963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
                                6⤵
                                  PID:6276
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
                                5⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:4392
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                                  6⤵
                                    PID:1756
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
                                    6⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5456
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
                                    6⤵
                                      PID:5416
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
                                      6⤵
                                        PID:5780
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                                        6⤵
                                          PID:6456
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                                          6⤵
                                            PID:6492
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
                                            6⤵
                                              PID:6392
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
                                              6⤵
                                                PID:6992
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
                                                6⤵
                                                  PID:7336
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
                                                  6⤵
                                                    PID:7428
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                                                    6⤵
                                                      PID:7440
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                                                      6⤵
                                                        PID:7516
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                                                        6⤵
                                                          PID:7616
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
                                                          6⤵
                                                            PID:7700
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
                                                            6⤵
                                                              PID:7916
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
                                                              6⤵
                                                                PID:7952
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
                                                                6⤵
                                                                  PID:6844
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                                                  6⤵
                                                                    PID:7828
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                                                                    6⤵
                                                                      PID:7820
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7688 /prefetch:8
                                                                      6⤵
                                                                        PID:8160
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7688 /prefetch:8
                                                                        6⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:6644
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
                                                                        6⤵
                                                                          PID:8124
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7756 /prefetch:1
                                                                          6⤵
                                                                            PID:8176
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
                                                                            6⤵
                                                                              PID:5280
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8244 /prefetch:8
                                                                              6⤵
                                                                                PID:2560
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=8296 /prefetch:8
                                                                                6⤵
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:5424
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
                                                                                6⤵
                                                                                  PID:5876
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
                                                                                  6⤵
                                                                                    PID:7056
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2956 /prefetch:8
                                                                                    6⤵
                                                                                      PID:5296
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12178791688431002607,5247804780860931870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
                                                                                      6⤵
                                                                                        PID:6016
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
                                                                                      5⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:216
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                                                                                        6⤵
                                                                                          PID:5036
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14330998095126341581,13131512047979638389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                                                                                          6⤵
                                                                                            PID:5464
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14330998095126341581,13131512047979638389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                                                                            6⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5472
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1160
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                                                                                            6⤵
                                                                                              PID:4324
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,1301809763642701943,1743794542418656453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
                                                                                              6⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:5528
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,1301809763642701943,1743794542418656453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
                                                                                              6⤵
                                                                                                PID:5520
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
                                                                                              5⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1312
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf72346f8,0x7ffbf7234708,0x7ffbf7234718
                                                                                                6⤵
                                                                                                  PID:2472
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4888150062784641433,7214869793558406855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
                                                                                                  6⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:5956
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4888150062784641433,7214869793558406855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
                                                                                                  6⤵
                                                                                                    PID:5940
                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ze9492.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ze9492.exe
                                                                                                4⤵
                                                                                                • Modifies Windows Defender Real-time Protection settings
                                                                                                • Executes dropped EXE
                                                                                                • Windows security modification
                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2796
                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3TJ79Wk.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3TJ79Wk.exe
                                                                                              3⤵
                                                                                              • Drops startup file
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Accesses Microsoft Outlook profiles
                                                                                              • Adds Run key to start application
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • outlook_office_path
                                                                                              • outlook_win_path
                                                                                              PID:7472
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                4⤵
                                                                                                  PID:6032
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
                                                                                                    5⤵
                                                                                                    • Creates scheduled task(s)
                                                                                                    PID:6704
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                  4⤵
                                                                                                    PID:3788
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                      5⤵
                                                                                                      • Creates scheduled task(s)
                                                                                                      PID:6400
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 3060
                                                                                                    4⤵
                                                                                                    • Program crash
                                                                                                    PID:1980
                                                                                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Av0Qh3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Av0Qh3.exe
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:944
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:6480
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:7248
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7472 -ip 7472
                                                                                                  1⤵
                                                                                                    PID:5840
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\AC1A.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\AC1A.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5628
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ADFF.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\ADFF.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:7880
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5628 -ip 5628
                                                                                                    1⤵
                                                                                                      PID:7036
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B62E.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\B62E.exe
                                                                                                      1⤵
                                                                                                        PID:5492

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77685100-39a5-421e-8251-3358d4fe3eed.tmp

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        926733eb05957f890ccda11f877f1292

                                                                                                        SHA1

                                                                                                        d0eb89659b62b2c221191092b49f31e3fafa101a

                                                                                                        SHA256

                                                                                                        b90f260c97651770a03adbb394dc2da240e451d1601d5cd5188232b31910061b

                                                                                                        SHA512

                                                                                                        bfa0d273691d8a63b4e907ba738f90f30ef85f0c84d3920785ecd5cfaaa4b54b6281a238652d52f504e11e35492c2a601d2c700cc820ba5e04a45237fc4dc23b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9eb698ca-d3ad-4710-9fe6-9f3214861b40.tmp

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        22350ae7a21ace3bc73c096a5b1d4686

                                                                                                        SHA1

                                                                                                        6f2de5555035d0bc702680d4daa7e352a9bd10e8

                                                                                                        SHA256

                                                                                                        bef2987efd3043114f1c8d9c1d1f426032b070f2bbcffb7535502a31b3927c91

                                                                                                        SHA512

                                                                                                        71bd39c94c6f97c0f18bd3963e481e8fc07a8ddf0a64f7ab816630da8e9ffc1e3559e018b6622be6a1528561ea9f7d2a3c33ba78b409e2810b7e3fc9801ff0c2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        b810b01c5f47e2b44bbdd46d6b9571de

                                                                                                        SHA1

                                                                                                        8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc

                                                                                                        SHA256

                                                                                                        d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45

                                                                                                        SHA512

                                                                                                        6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        efc9c7501d0a6db520763baad1e05ce8

                                                                                                        SHA1

                                                                                                        60b5e190124b54ff7234bb2e36071d9c8db8545f

                                                                                                        SHA256

                                                                                                        7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

                                                                                                        SHA512

                                                                                                        bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        MD5

                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                        SHA1

                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                        SHA256

                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                        SHA512

                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d49a228-dbf9-47f5-9102-9d95b3837557.tmp

                                                                                                        Filesize

                                                                                                        3KB

                                                                                                        MD5

                                                                                                        dd64b4c2e4ab7ab76f0c7f735a8fa8ba

                                                                                                        SHA1

                                                                                                        ab2679cb0dbad9de7b617a7d21c02a0e3dbeaaf2

                                                                                                        SHA256

                                                                                                        2c20fffbb34a3dab9ecbb33c2cc9e08924e540bdfaffda06542445a666fec7f8

                                                                                                        SHA512

                                                                                                        42894b169281843b0fbdb6689e9dd06be349e83d16f030232347e4c8aef8371a41b5ed1d67965e56b475d14d84a6272c87a43f4a9fe0ca9d8cf7ed5b92f7daec

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

                                                                                                        Filesize

                                                                                                        201KB

                                                                                                        MD5

                                                                                                        e3038f6bc551682771347013cf7e4e4f

                                                                                                        SHA1

                                                                                                        f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                                                                                        SHA256

                                                                                                        6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                                                                                        SHA512

                                                                                                        4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                        SHA1

                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                        SHA256

                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                        SHA512

                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                        Filesize

                                                                                                        396B

                                                                                                        MD5

                                                                                                        166611951a76d09eaa8a2144b27ac8a2

                                                                                                        SHA1

                                                                                                        7071d5b82ecd9400d62e994982e93a5659254630

                                                                                                        SHA256

                                                                                                        47eb20d6fa614db8f75d0b737892cbf3e73ccc59b061316d9bc3e49e1df8cf17

                                                                                                        SHA512

                                                                                                        b8388983c3b1442ac403bda746c581add457046f4559bd3c6899fb6f5bcc10c37f9439e5509364d2ef7f044d7ee968cfefbff03c4a440fa6fbd42433f291935d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

                                                                                                        Filesize

                                                                                                        396B

                                                                                                        MD5

                                                                                                        040edff1c5dbd1120879ceb73ab5f674

                                                                                                        SHA1

                                                                                                        76316c3b889c21def5f81894f020259fab05ef80

                                                                                                        SHA256

                                                                                                        8a0686acad63088ffed3ecfd747a6615a020ab54ef87b8650f09ecbeb52a561f

                                                                                                        SHA512

                                                                                                        55e6b1183b70bb48c81429d1848b0f042043469b402454a820695565ef22c97443482bf0b0563194b8bcaf912ff971c0cfa545aa99603041209cb7a9585c46fc

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe589c5a.TMP

                                                                                                        Filesize

                                                                                                        355B

                                                                                                        MD5

                                                                                                        bc93d5b48903b293361ed7c66cc7fca6

                                                                                                        SHA1

                                                                                                        848fbbabd682690b61f22e7a6d6a794c4f495586

                                                                                                        SHA256

                                                                                                        ebcdecec3a1e402d5fe00758f9720395dd8372b1ccca5794a0be9e806a3b5d86

                                                                                                        SHA512

                                                                                                        8f0e6e86a089a2a0198d5bd74c21d928f91a247f6e552e5311c1008aa3c33407c30209dd25c6938bfc65485482f6ae860a6913126e1a8b5fed7c513948695814

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                        Filesize

                                                                                                        23B

                                                                                                        MD5

                                                                                                        3fd11ff447c1ee23538dc4d9724427a3

                                                                                                        SHA1

                                                                                                        1335e6f71cc4e3cf7025233523b4760f8893e9c9

                                                                                                        SHA256

                                                                                                        720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                                                                                                        SHA512

                                                                                                        10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                        Filesize

                                                                                                        111B

                                                                                                        MD5

                                                                                                        285252a2f6327d41eab203dc2f402c67

                                                                                                        SHA1

                                                                                                        acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                        SHA256

                                                                                                        5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                        SHA512

                                                                                                        11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        c09abb66dc8fa13923c1bcf57e55266a

                                                                                                        SHA1

                                                                                                        7730373b24652d37da193af0cc2e40e632302e12

                                                                                                        SHA256

                                                                                                        c77e5303d2a7e95e0467f149c060d3fb31c91919a1c6559594ab7f1dbda0dd16

                                                                                                        SHA512

                                                                                                        ecb4c2c16c70de5dc69a8fa5612dafe80eae8b534a55ae4d699c7f33bacbd9e360dd3402bf6d032aafc2c5c560f91969b2b050bf3b3fbe76e969762cffe486f3

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        e6931c5f417dfca0cf068f800f6ff86e

                                                                                                        SHA1

                                                                                                        91774bd423c216d437658fabcc8431346079ad86

                                                                                                        SHA256

                                                                                                        f09b39fd1c773ca591bb8bdc455ab949e479316c964db842cb5a8af9cf37989c

                                                                                                        SHA512

                                                                                                        ab3639c15eb351e99e323f7a08fff52f540fa2c89999f7d0e2dc064dc695526163e80f941db52b887de3676b3e710fd887758b01d280e88b8aa6f4e2bc6f4155

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        05a53f32688f3034c1a694fe84d42aae

                                                                                                        SHA1

                                                                                                        702d2a9b3676b1f1f8947f772f15c70bcc49779e

                                                                                                        SHA256

                                                                                                        564426b1ff94cfa07617176953e2159b07ed0245ba61754a9a4e531515c4e20e

                                                                                                        SHA512

                                                                                                        dd15bf8dc8291cffbb75694bc79a7cb1596cbf893d8e49b7e6d4ab7bd2042699f82dab94e3ee20d30f5a956d853a52689e1cac1e9e9064e207d2f85c34abaa08

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        87c1383f7e88bf5c518a3d737d4d04f8

                                                                                                        SHA1

                                                                                                        eac7a921db2e79f0ff211890af8faf42e68072e5

                                                                                                        SHA256

                                                                                                        cfee21ef8b05dec990cb8e458dab4a51d9ae1d6d118ac552147aa014b9a406da

                                                                                                        SHA512

                                                                                                        fd90b3783f7d1a59e4276ff31ae9d23b63ef2cb539fe074651d9dac6b6f5ad0b950b185faaf3c349c3ed99e18bea48a20141896767e0ae91a94ec08cf461a15e

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                        Filesize

                                                                                                        24KB

                                                                                                        MD5

                                                                                                        121510c1483c9de9fdb590c20526ec0a

                                                                                                        SHA1

                                                                                                        96443a812fe4d3c522cfdbc9c95155e11939f4e2

                                                                                                        SHA256

                                                                                                        cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

                                                                                                        SHA512

                                                                                                        b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                        Filesize

                                                                                                        89B

                                                                                                        MD5

                                                                                                        29f898d156fa1337f8d653f9fc26f7e2

                                                                                                        SHA1

                                                                                                        22b7ad0702e26e69cb7871ca2cca61ae1d677cb9

                                                                                                        SHA256

                                                                                                        67ea8e3a141270272e0a0913adf01b4d8298246a202b48fef87fb9b92a648871

                                                                                                        SHA512

                                                                                                        f9e48cd067c4342f8dd30eb1a7a77205ee1790be7abdcec1d58135ff62a3aac19d0772de98952e783d9733f803cebdc2634cf244fa2da474bb001451f2d9efe4

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                        Filesize

                                                                                                        146B

                                                                                                        MD5

                                                                                                        cec8f5fc500202b94749668c404ea146

                                                                                                        SHA1

                                                                                                        c5c40d0edcdbc36d44e870650b205c6f2d229f8a

                                                                                                        SHA256

                                                                                                        7cedc37dd69394d81f7c33241c73bf906d564f99a8b28b7dcc7ce1d859d2125c

                                                                                                        SHA512

                                                                                                        2f868ab8b19d216c8f69d502f18139f510c63fc041379fff8176e89782a6846d2d3d77fa9ca56f312235e502dbd03e1c98a3a03a113c7ea7bbebcfc867a603c7

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                                                                                        Filesize

                                                                                                        82B

                                                                                                        MD5

                                                                                                        7ed9900f9db06cf5d46674a4fa8be9b9

                                                                                                        SHA1

                                                                                                        7332d4e0e4b074dbe96d0da3522eaa6f8ef5b220

                                                                                                        SHA256

                                                                                                        3af89de01cd5812c238df0d517d1b8c81dfdae52df0afac7cf9d1ef57610dce9

                                                                                                        SHA512

                                                                                                        2fd57463229959d0dab16687fc8cdf889eea4d069603e17bda798410fc62fc470f7b777400b3a48b7145138d4e621b308b0ff6cf07c745578c3b7cd16c0570b9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

                                                                                                        Filesize

                                                                                                        83B

                                                                                                        MD5

                                                                                                        eeeac8a1e2476da86449dab323649f3a

                                                                                                        SHA1

                                                                                                        e0aa8898a05a0716312efb51ca02eaff13395d5a

                                                                                                        SHA256

                                                                                                        0000143c2c5e62e6217cc563132e836c2d5725a8fe0eefe1cd404614403c1640

                                                                                                        SHA512

                                                                                                        a6fa89bfef8ad35a31d052edee077132ada2744066ac41525fe38c9d1a1f7741188f74934a6a39eeee3f71c8b9bb6dff3de33af37949a1cc0f020eb0ed8e6204

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        24f7e5c0b14d4f1f52ed926029114359

                                                                                                        SHA1

                                                                                                        838eb32d36f547978ffeee09c11ea0f904067f6e

                                                                                                        SHA256

                                                                                                        d0e7871ddb179859eb8557e2e0c7c770f81f1f92f8f843ccbbb05880bcdbef58

                                                                                                        SHA512

                                                                                                        700ad07f6ae758e438766eb18942fbd13e929f840cb8d2a233cabd0eefb9414278c8d3c8dbded529a3b6ce8fb165a87db8a8cd3e0b1752d034319da7f7302439

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        8a30168937ef9ec8bb95721f9105575e

                                                                                                        SHA1

                                                                                                        6909d2ee1bab6fcf7a91779123a7701b12ec5fe5

                                                                                                        SHA256

                                                                                                        8fca8428f26b117c4c18a7a049d73aec8697e84a1fae3a4a801c18245091df31

                                                                                                        SHA512

                                                                                                        955d99cc74a88d26fff73bce9e4ebd5d3caeb698e0f1ad53f1c87bdea5d469d27db4f19b037a5b55f86d5c598860198d3a3b5bece8b08b55d320293218080477

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843ca.TMP

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        2887876f952d3627ab677e61a465500a

                                                                                                        SHA1

                                                                                                        2c8a6b4b8c265ed386952879208cca36eaeb7e52

                                                                                                        SHA256

                                                                                                        0441b6c8ba3b4a8a131fb0137a97a7986100497ebc1a32f12f4e8a4582c1c989

                                                                                                        SHA512

                                                                                                        bfab7d742aa5bffd9b2aaac74e7b32c233a7913091f7dea072722fbe1638e9002a3c7237f375b9722ea0d64dd4e93c418c2a9bb7fd3af51b7dbf4c1f7d102ef2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                        SHA1

                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                        SHA256

                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                        SHA512

                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        c60447483fcac4b828d8f204724849b7

                                                                                                        SHA1

                                                                                                        ab33df2a21d3dce436293a9d920a6d5b49079cf1

                                                                                                        SHA256

                                                                                                        0b8342cd088af2de5819e9a78e95c8a8e11b146a5f3e80bb5931ef191ea467ba

                                                                                                        SHA512

                                                                                                        43160ed6f19a96642fe26b3eb1a650e5ed23b9bba7bd127d6d041d01166d2a4329419e019481d1d185997b102ca13c5846256ecc173d543f9aa0caae9df3dd73

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        9c0844faff36d65e6f5465430a015c23

                                                                                                        SHA1

                                                                                                        6ce5924081a7a2fa70a41e3ce930a89d968de404

                                                                                                        SHA256

                                                                                                        42f3de6e706eec6fc69ef44307e6f52410d6511f11284fa5f4a7c7f0876f9671

                                                                                                        SHA512

                                                                                                        600c7483db8794dbea067b28033e74fa6c724c50be5badf366156203052ea39ac8c9a5ad18e7bbc3746222b38edbb200da9a1b5f1c044de39e931a72c8fe17c9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        10KB

                                                                                                        MD5

                                                                                                        7d1005a465eaf66ef405a7e189989697

                                                                                                        SHA1

                                                                                                        2a56e1db3111c12dd11cbb1c8cccc62971be1d8c

                                                                                                        SHA256

                                                                                                        f07ee0ed8703b6533a1499a3825cf41798644324d4ed14dc120c849e3c0b0bfc

                                                                                                        SHA512

                                                                                                        2a009db2da144b65753d2fdee48a2a50ea2696e4e5a287e53e1805df4cecbd0bae91bf10d8e2cfa3bfa86dd03d489f14c77412826ee3aac387807a35acbc392c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        10KB

                                                                                                        MD5

                                                                                                        c30c5892b2f55b1dd6fe26c382144144

                                                                                                        SHA1

                                                                                                        ca0e33500cefd48f37c1bbcec2fae0678ac0396d

                                                                                                        SHA256

                                                                                                        867584f08c38d1728b9df8e70b38c14e165bc162bbe800ebf34f05c4c8c3399b

                                                                                                        SHA512

                                                                                                        60a3c967612defba9b9c18e31619993b9c343b2be8f2d01b6b9b28eb7a8ab35dc56254e551520544696efafaf708cc031723bcc6c3c7ab410a2057036fb82690

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d32ef6f4-1e95-45e1-8d79-68681375f867.tmp

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        48593366b4d6e3349a74481eae584874

                                                                                                        SHA1

                                                                                                        f6a4a63912eb6e73c2395292452fc94a40d7d855

                                                                                                        SHA256

                                                                                                        2106277d95ce2bb1706d344bf21477a9217ad58730e237117a980eab0f019f89

                                                                                                        SHA512

                                                                                                        5e8dde2578066e03958f57fe016c9231fab6407a4eb99adf6f4b228ef23d638f4cc606bf36370f3e0d0c451d82ce6da1799c7c7d6bb904a0ba00663398dc4b60

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

                                                                                                        Filesize

                                                                                                        802KB

                                                                                                        MD5

                                                                                                        4ef83bf51ae6dd5861d78e56dd25ce42

                                                                                                        SHA1

                                                                                                        14b619f8a1e8fda9062f0ecdaaf37d12e5be9fd0

                                                                                                        SHA256

                                                                                                        25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea

                                                                                                        SHA512

                                                                                                        c14dec81372cc9f93e13237e79dfdfafd3971a2250b23843f67012672301744bf21f1a1a23ae182acc37d73ba66fce8bfba6e9bc2871172f06bc078bd486e4b1

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC6pY31.exe

                                                                                                        Filesize

                                                                                                        1.5MB

                                                                                                        MD5

                                                                                                        b2a260e462944baf1d442a67be42a2db

                                                                                                        SHA1

                                                                                                        3432171e4f13d41aa18a5996c88a5d4fd1f66271

                                                                                                        SHA256

                                                                                                        5c2aedbba87540686fee514397149c607335f8d3eba545833af61accb29c5be1

                                                                                                        SHA512

                                                                                                        7e5fdd364d6450092ed355efe3bab87002744ff962dba67bc3603aeacf693022c9504696047cf683426579b36412ed6260f8c5895502d59c07e95c339a3448be

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mT4fC12.exe

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                        MD5

                                                                                                        1d4319deb4469abca1da4e98933d7520

                                                                                                        SHA1

                                                                                                        a6e3477f34238c34627cd374e189af77e485b551

                                                                                                        SHA256

                                                                                                        72d1643a82d8ec904ad6c67367905db2a130b03567cce96bbe0ea3b379e551e7

                                                                                                        SHA512

                                                                                                        3f016345faf39dd8d999bfc5f994e154519df7e4f8c4318b9f455d84136b2b4b88510c0b0ff4409720c43465a5fdd264e45027df32bd6ec7ee28b286e350577b

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cj90Bz9.exe

                                                                                                        Filesize

                                                                                                        895KB

                                                                                                        MD5

                                                                                                        0bbb6695ef1d8770b366079037f2c626

                                                                                                        SHA1

                                                                                                        6e915e7868072aa858c3a66a310b743babc173e7

                                                                                                        SHA256

                                                                                                        25b844e1855047b3bf218d0b9d4663744a2a41a4fea19f46462ffdec5877f84b

                                                                                                        SHA512

                                                                                                        e7d5c0b6b6c9e420af676a22c5a2b5f71d5ccc7f9434e85191c747e2dbf82f5f691a0e27ca70e9c4dc381a50e4b6ae0ea7386cafd5fa11b94872cd1ec5339795

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ze9492.exe

                                                                                                        Filesize

                                                                                                        603KB

                                                                                                        MD5

                                                                                                        09ad33bc3340bb460945f52fc64d8104

                                                                                                        SHA1

                                                                                                        8961fb7b80dd09fb1f7936e1a488340076d241b3

                                                                                                        SHA256

                                                                                                        a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5

                                                                                                        SHA512

                                                                                                        2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ze9492.exe

                                                                                                        Filesize

                                                                                                        384KB

                                                                                                        MD5

                                                                                                        933cbdc48d04f117458067f63505e887

                                                                                                        SHA1

                                                                                                        497b9f56994a837f263c71c08eccde2621944800

                                                                                                        SHA256

                                                                                                        3fd54d9031908e82ac53ff8de585393bd5b95714fde3e9c8a302434dbed1552c

                                                                                                        SHA512

                                                                                                        c7008a483e27933c6392d672080fcb083d9b07b6239c806bc103debda4950ce778ac8ce25dc9dcbb0a58a77eac189926a708796562f57bf12537ad4dce554411

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tempAVSD4slAzsqNwLV\EqMNXpGS7CMmWeb Data

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                        MD5

                                                                                                        f70aa3fa04f0536280f872ad17973c3d

                                                                                                        SHA1

                                                                                                        50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                        SHA256

                                                                                                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                        SHA512

                                                                                                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tempAVSD4slAzsqNwLV\ibvNSLJkxF7iWeb Data

                                                                                                        Filesize

                                                                                                        92KB

                                                                                                        MD5

                                                                                                        ec564f686dd52169ab5b8535e03bb579

                                                                                                        SHA1

                                                                                                        08563d6c547475d11edae5fd437f76007889275a

                                                                                                        SHA256

                                                                                                        43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433

                                                                                                        SHA512

                                                                                                        aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9

                                                                                                      • memory/944-745-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/944-821-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/2796-118-0x00000000007C0000-0x0000000000B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2796-479-0x00000000007C0000-0x0000000000B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2796-109-0x00000000007C0000-0x0000000000B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/2796-40-0x00000000007C0000-0x0000000000B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.6MB

                                                                                                      • memory/3588-819-0x0000000002650000-0x0000000002666000-memory.dmp

                                                                                                        Filesize

                                                                                                        88KB

                                                                                                      • memory/5628-1280-0x0000000000400000-0x0000000000892000-memory.dmp

                                                                                                        Filesize

                                                                                                        4.6MB

                                                                                                      • memory/5628-1276-0x0000000000A80000-0x0000000000B80000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/5628-1277-0x0000000002520000-0x000000000259C000-memory.dmp

                                                                                                        Filesize

                                                                                                        496KB

                                                                                                      • memory/7472-489-0x0000000006E80000-0x0000000006EF6000-memory.dmp

                                                                                                        Filesize

                                                                                                        472KB

                                                                                                      • memory/7472-484-0x0000000073E80000-0x0000000074630000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                      • memory/7472-631-0x0000000004A80000-0x0000000004AE6000-memory.dmp

                                                                                                        Filesize

                                                                                                        408KB

                                                                                                      • memory/7472-559-0x0000000007F00000-0x0000000007F1E000-memory.dmp

                                                                                                        Filesize

                                                                                                        120KB

                                                                                                      • memory/7472-481-0x00000000000D0000-0x000000000019E000-memory.dmp

                                                                                                        Filesize

                                                                                                        824KB

                                                                                                      • memory/7472-500-0x00000000023D0000-0x00000000023E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/7472-560-0x0000000008460000-0x00000000087B4000-memory.dmp

                                                                                                        Filesize

                                                                                                        3.3MB

                                                                                                      • memory/7472-743-0x0000000073E80000-0x0000000074630000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                      • memory/7880-1296-0x0000000007FB0000-0x0000000008554000-memory.dmp

                                                                                                        Filesize

                                                                                                        5.6MB

                                                                                                      • memory/7880-1293-0x00000000743E0000-0x0000000074B90000-memory.dmp

                                                                                                        Filesize

                                                                                                        7.7MB

                                                                                                      • memory/7880-1291-0x0000000000D40000-0x0000000000D7C000-memory.dmp

                                                                                                        Filesize

                                                                                                        240KB

                                                                                                      • memory/7880-1320-0x0000000007AF0000-0x0000000007B82000-memory.dmp

                                                                                                        Filesize

                                                                                                        584KB

                                                                                                      • memory/7880-1321-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB

                                                                                                      • memory/7880-1322-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

                                                                                                        Filesize

                                                                                                        40KB

                                                                                                      • memory/7880-1325-0x0000000008B80000-0x0000000009198000-memory.dmp

                                                                                                        Filesize

                                                                                                        6.1MB

                                                                                                      • memory/7880-1328-0x0000000007E60000-0x0000000007F6A000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.0MB

                                                                                                      • memory/7880-1329-0x0000000007D90000-0x0000000007DA2000-memory.dmp

                                                                                                        Filesize

                                                                                                        72KB

                                                                                                      • memory/7880-1334-0x0000000007DF0000-0x0000000007E2C000-memory.dmp

                                                                                                        Filesize

                                                                                                        240KB