Malware Analysis Report

2024-12-07 22:57

Sample ID 231227-bh5xladcej
Target 32ca687e2c6a86e281da19eb9d5996bb.bin
SHA256 ed15d20266a8594ee3fd30b8641dcee91f09c1657894d640d9064240f2a33fef
Tags
persistence paypal phishing
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ed15d20266a8594ee3fd30b8641dcee91f09c1657894d640d9064240f2a33fef

Threat Level: Shows suspicious behavior

The file 32ca687e2c6a86e281da19eb9d5996bb.bin was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence paypal phishing

Loads dropped DLL

Executes dropped EXE

Drops startup file

Looks up external IP address via web service

Adds Run key to start application

Detected potential entity reuse from brand paypal.

AutoIT Executable

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-27 01:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-27 01:09

Reported

2023-12-27 01:12

Platform

win7-20231215-en

Max time kernel

3s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2856 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2804 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe

"C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.linkedin.com/login

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.linkedin.com udp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 104.244.42.65:443 twitter.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 104.244.42.65:443 twitter.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 34.230.251.118:443 www.epicgames.com tcp
US 34.230.251.118:443 www.epicgames.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
US 8.8.8.8:53 static.licdn.com udp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 crls.pki.goog udp
GB 142.250.200.35:80 crls.pki.goog tcp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 151.101.2.133:443 tcp
US 193.233.132.74:50500 tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 151.101.1.35:443 tcp
US 151.101.1.35:443 tcp
PT 13.225.9.161:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 crl.r2m02.amazontrust.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
PT 13.225.9.161:80 crl.r2m02.amazontrust.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 100.26.116.134:443 tracking.epicgames.com tcp
US 100.26.116.134:443 tracking.epicgames.com tcp
PT 13.225.10.50:443 static-assets-prod.unrealengine.com tcp
PT 13.225.10.50:443 static-assets-prod.unrealengine.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
PT 13.225.9.161:80 ocsp.r2m03.amazontrust.com tcp
PT 13.225.9.161:80 ocsp.r2m03.amazontrust.com tcp
PT 13.225.9.161:80 ocsp.r2m03.amazontrust.com tcp
IE 163.70.147.35:443 facebook.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 151.101.2.133:443 tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
FR 216.58.204.78:443 www.youtube.com tcp
FR 216.58.204.78:443 www.youtube.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 151.101.2.133:443 tcp
US 151.101.2.133:443 tcp
US 151.101.2.133:443 tcp
US 151.101.2.133:443 tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

MD5 f6f0315f30927dfd9912668696242967
SHA1 e6eb562c8a10517dbccbe86d50d7fa6cb1eccec8
SHA256 0b96e1e4aa9301ddc7b299f57d67fd80596f540d4870da975de01db277878c09
SHA512 b76fdfb96698af550f3bcf25fa2378c86aa0af0129148264e692fa9ad74ec94b1e0fc43a47adcb1dd7b6e7e61d2529862eadf8595fc22649088cfa9d599299e0

\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

MD5 3c8211dd0c055db90c5830912f91d56b
SHA1 c0672cf5c40c66d378078fb32a3919328969ae68
SHA256 885ae7a84e40592d44b54a7d049c765adc06790cb067f9459745b8bb9d5b07e8
SHA512 3ef751d681886b546f2f69308230e9aa6b4097d0756af2afc120dba20f36479a258703defde2c5d07e9604fffd56521cafc1224963d954c0442ab98aa8b9990c

\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

MD5 349569ac73fe89dca5497985d1cad4ad
SHA1 1de4f5702b216d53116ba5aa972cebcdf9891be9
SHA256 406a834c85dd8b39d5f09bf1d2524e26af421b34a1b72af3182e762de6f1ce5f
SHA512 3706aa5f2057cc5d69d134691749e2c8f815e340cb7bdbe56295ab2dce1746e963dc507cb904876d461b84e6d6b57bbb170962f1d243a8f944939256beed570a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

MD5 5aa94b2a183736838a1104cf78a7c59d
SHA1 bbf3f993db9263ae80c21081bb0ae607b00c94df
SHA256 dddf21918eb7ab6fac235012392887f4bfbbaae9d080ca17c1527a82ca3e5919
SHA512 42c41f5ca3c3f70ffae4137cd4306627cfc57d836587fc91d3903f15f497a401ebfb64d4e6ef7f69cf666d498321e4601a18d38ebb53b66dd227edca21d1c030

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

MD5 c1aa224b17fff32c2ec9942b791afc1e
SHA1 6fb1a7e5d753504bb061741b9b1a0f2eca25f253
SHA256 c3b5f53524fca47d461ad8e9304d719c593873414b6f454fb3c768dd7238c218
SHA512 8d741693eb0ba6d1fe30c9f8dd22ece6af582311fd207cc9d12290a77964fa6a9aa4b1ed30c2e1ad0e8f84e84ecb498aee4e86f15134fa0ff14bc9c10e5f57cf

\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

MD5 c27ad4078641061c0e777add1c7e912f
SHA1 3bafdef76913c28097ca5854910a3de317df4c8f
SHA256 9f2bd0d3b103a8b4e9a45a0381974efa444e807719f5d9cf3243fa73982e69dd
SHA512 07053240d7ae8abb840a3477e1eecfe43adc131d47fc9d40f12b75c1021fdc1451cc35f5036fa47c9c402b7d132ee01434a02c754ae51a3fe1b26ecb352f88f1

memory/756-20-0x0000000000C50000-0x0000000000D1E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-27 01:09

Reported

2023-12-27 01:12

Platform

win10v2004-20231215-en

Max time kernel

150s

Max time network

170s

Command Line

"C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1815711207-1844170477-3539718864-1000\{9EB5D8E5-8601-47EA-B36D-B49A83B1EF90} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 1744 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 1744 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe
PID 768 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 768 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3428 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3428 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 2760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 2760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 1748 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2228 wrote to memory of 1112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2228 wrote to memory of 1112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1668 wrote to memory of 3204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1668 wrote to memory of 3204 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1020 wrote to memory of 444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1020 wrote to memory of 444 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1448 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3344 wrote to memory of 4972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3344 wrote to memory of 4972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3396 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3396 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1744 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe
PID 1744 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe
PID 1744 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 5584 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 5584 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 5584 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 5584 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1892 wrote to memory of 5500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4324 wrote to memory of 5584 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe

"C:\Users\Admin\AppData\Local\Temp\44ae5bcd4f1efbb30cf46e88b8fe6ff722c38d7101aeb2cb381b9f108312978c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4ZM853ko.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffa96f946f8,0x7ffa96f94708,0x7ffa96f94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4656739098464995591,4066232496856231725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17006900276907430633,11340518101932526851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6829997628410049990,17662497065892853158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6829997628410049990,17662497065892853158,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17006900276907430633,11340518101932526851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1709057427032135822,4801770081039417525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1709057427032135822,4801770081039417525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14486857255842311746,631207468593378412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14486857255842311746,631207468593378412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1982459839636396306,4182511239039062621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4656739098464995591,4066232496856231725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1982459839636396306,4182511239039062621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13625047361038622142,824984984869543643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13625047361038622142,824984984869543643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,13422635724614832577,3657325697618889667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13422635724614832577,3657325697618889667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9484 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=9156 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8984 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3f0 0x4ac

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9003520112967293633,3305957416751564598,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 104.244.42.65:443 twitter.com tcp
US 104.244.42.65:443 twitter.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 84.166.233.64.in-addr.arpa udp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 store.steampowered.com udp
N/A 224.0.0.251:5353 udp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
US 54.86.74.154:443 www.epicgames.com tcp
US 54.86.74.154:443 www.epicgames.com tcp
IE 163.70.151.35:443 www.facebook.com tcp
IE 163.70.151.35:443 www.facebook.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
GB 142.250.187.206:443 www.youtube.com tcp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 154.74.86.54.in-addr.arpa udp
NL 52.142.223.178:80 tcp
BE 64.233.166.84:443 accounts.google.com udp
US 8.8.8.8:53 89.10.225.13.in-addr.arpa udp
GB 142.250.187.206:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
FR 216.58.201.118:443 i.ytimg.com tcp
FR 216.58.201.118:443 i.ytimg.com tcp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 api.x.com udp
US 104.18.37.14:443 api.x.com tcp
US 8.8.8.8:53 14.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 118.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 104.244.42.2:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
GB 151.101.60.158:443 video.twimg.com tcp
GB 199.232.56.159:443 pbs.twimg.com tcp
US 104.244.42.133:443 t.co tcp
US 8.8.8.8:53 2.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 158.60.101.151.in-addr.arpa udp
US 8.8.8.8:53 159.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.42.244.104.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 static.licdn.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
GB 95.101.143.16:443 community.akamai.steamstatic.com tcp
GB 95.101.143.16:443 community.akamai.steamstatic.com tcp
GB 95.101.143.16:443 community.akamai.steamstatic.com tcp
GB 95.101.143.10:443 store.akamai.steamstatic.com tcp
GB 95.101.143.10:443 store.akamai.steamstatic.com tcp
GB 95.101.143.10:443 store.akamai.steamstatic.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 95.101.143.10:443 store.akamai.steamstatic.com tcp
GB 95.101.143.16:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 16.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 10.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 104.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 8.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 100.26.116.134:443 tracking.epicgames.com tcp
PT 13.225.10.50:443 static-assets-prod.unrealengine.com tcp
PT 13.225.10.50:443 static-assets-prod.unrealengine.com tcp
US 193.233.132.74:50500 tcp
US 100.26.116.134:443 tracking.epicgames.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 50.10.225.13.in-addr.arpa udp
US 8.8.8.8:53 74.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
FR 216.58.204.78:443 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 43.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 www.google.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 172.217.169.10:443 jnn-pa.googleapis.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 4.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.recaptcha.net udp
US 152.199.21.141:443 abs.twimg.com tcp
GB 172.217.16.227:443 www.recaptcha.net tcp
US 104.244.42.2:443 api.twitter.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 104.244.42.2:443 api.twitter.com tcp
US 192.55.233.1:443 tcp
GB 172.217.169.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 sentry.io udp
US 8.8.8.8:53 www.epicgames.com udp
US 34.193.183.76:443 www.epicgames.com tcp
US 192.55.233.1:443 tcp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 76.183.193.34.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
GB 142.250.200.4:443 www.google.com udp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1PZ89wW4.exe

MD5 fa22ddbf31b13b2a7a68188fd040c470
SHA1 ea4efe59435a59680c67ec8a2d0ff932b2e6939b
SHA256 3dbcf1b1780714e1ebb7104bb1384de0d91e875d8f7f10de19319f20a0fe8f68
SHA512 22565611d67607b0157d53e8e9bedc3e54ebb470c84784d9d562b55ea0eb38a3bb9eb66f9190fa1717c46f746cf95a0197f918e3aea8eadbf5e8b2eb8670d30f

memory/2692-65-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/2692-56-0x0000000000740000-0x000000000080E000-memory.dmp

memory/2692-66-0x0000000007520000-0x0000000007596000-memory.dmp

memory/2692-83-0x0000000007620000-0x0000000007630000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8a4d77ce24eb39b58ecb68f04c7f211a
SHA1 322f660cb003021a7953368cd48743cfca3bdb42
SHA256 06fc99792f5871a12eabc6949507922d5243777f40fb677a2f2c4f5b7b17592f
SHA512 1df476eb6fa0bcf9ecd03759fab56d81f0be563fa546d286b40d598cd28415e56223d449ee53b024a1445c8b51ad8ec58ed312dcb943b6a346ffac19cffd69bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 19130e8da388159ccd5a160c6e933959
SHA1 7f95963fbe2667fb14436601f9b86b4686e21bf3
SHA256 a24e73d9218e14284c8e1603dbbbd46947cf5dddee9034490a1af9cab01a9879
SHA512 fee6d8d6c4e3fa39b347fb03d7a785c39d840eded9f91d35cb90e15181f13bb37771c0006c862de4dc7acf789daf96caf91b58f3f62ce9d309e8ae02268b2345

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6c6a6aa0334d40c458e6795666010bcf
SHA1 08a4a03378b09b5bbd9882c3c76b8a623cad831b
SHA256 e5570ec8e22ec73cafba93f975952c1ec306b2020b713fb134fa7dd3a630b43a
SHA512 29583dc9dae79bd6c5ee399eb1ba17d137d6a30b92aa732b2816fae307126a0914f3d615a27891d4d39dd8f8baaf799c937fc3c413b0c072aa1e1b22d6f29e7e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 084a588f177d12fdd0775fe440ceac17
SHA1 772ff82cbe68ab7fb999aebb87870aa1ad6db81f
SHA256 c4e4eba39c9a5541e7973568253d352c37b669461450b1547905c5b1a7a656ef
SHA512 665936eb3865c489f168fc447639ede5a7bc486a2d30f5b26e71363fbaa0daa1f63fbfd178dbe1da91eaa9d1a0770723eaa73c128e413d682813aaca1b91a0db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 38eb75ddfbd541dbd3b05b646ff41fb9
SHA1 883f9d10bf74b9129ed73b4f3e0bc82974fdeb34
SHA256 1819f4d8c8000aa9cce1b91f70b32b5b963077b2284e6f8e72149bc89d4c8c21
SHA512 feaa65bac4aa3dcd64765aadff94920a363f7b5d77e644fa59d0201477ab0b98ed5d4672e9bb542ac197fadcec4c8118342c09d0774dcf39c13ce995f7fb27e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a030323a-6134-4a35-9143-a254716d55c7.tmp

MD5 1156775b466322c4fb3b91c1098fe8d3
SHA1 78fc718dd448ad6bf5fba79e21c5aa682613e48d
SHA256 6737ad8eb1d3daf83f7d3d33bf080fd4cce3a7f8054ba95d27ecaed9de905e2c
SHA512 de3131424db7e7b1e9271e7104dda7c991b19c43cccfa8a0d0d2a37cf5b8842613461b0b94d2b16e7eb492e6d2aedc83464869343f6821e6d23e5bebb65a6dc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98fbe51e-6ee6-4e9b-a035-ae23c04e7d3e.tmp

MD5 f7e8e422d86d2f2cb8dbcdd868178ae6
SHA1 75ab8647cda68902a346d957417e532e635a9d43
SHA256 7f63063d4c8a40eecfc7ec81d6014b7727e89ca4ff170f6bba9c465642eb58f0
SHA512 5c243a6b9cb8e753a5c19210b78a1637f4c6228f8b26cb5f7737ad3cfcdf69000c57cc1a74a8b0b6b00c62a3cf8e55dac582a38d9132dd4292398811cd94da9b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b376a602-55ec-460f-974a-6a6b93e15367.tmp

MD5 b6671aff8cef07035c080df61cf72c38
SHA1 595df430b7300cf89c5540dbe32c053f7e2b96d4
SHA256 344be58b8cb7c257d11d1a730d90f965ecb3735e0ee6bc53f87cedcf99489ef9
SHA512 3515f43d43f6198918f610463040301c784bad421eb104cf30eb447f4801bc13a372312ee9721c232bb0a8e120c46b983382decc02c923cd5042026f62fb4cf0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78b6ed21-cd58-47f4-9b8e-3d2ac3a14633.tmp

MD5 648e250a1815c7cbb61ef76d2cffc002
SHA1 f394d11241ea40bae9b3c6c1a0ed9bcae3d472a3
SHA256 616fd2f70826bb8b5fd05a570b859681cee3f47e2c9ca0e76add8e4ce7192dbf
SHA512 7d4e8dca75ab4fefb55adb184a5c207cdb74e75c61854ae7782b2c4f47f2d61cd891b44e6c5064e613f8a5371c73be26b9aa3cf41373aa05af32402049d7c1a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0ac518c374266e63990df1bbf6d6cd8b
SHA1 98c41f9e96aab686237c92f900195e8f161ab036
SHA256 7b059d8f1778820372ffba5c399318a209dce07276812f8556d0b7ada7191583
SHA512 2d5979f60173e2ba64c9b19b21da010767eff36a0ec5ccbd7ce93f9a30539df413bdc630eaa65fa7ef5f1cbf09fdc9bdbe8edf6402a5d3bd62f1090e4543324c

memory/2692-273-0x00000000745D0000-0x0000000074D80000-memory.dmp

memory/2692-274-0x0000000007620000-0x0000000007630000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dc35c2ecb446d264ef088085f3a3809c
SHA1 aa1619fbd9220ef3a76c01a80405b560e5972a67
SHA256 47d3c82e39fdf1c9e05000e2a0ad4679e043c2b323ce1529906a6c0a6fb53136
SHA512 685d4557e492f9d8afbf3b07041d48aa17ef40c85088a888433f6c4ef8f4f322df76aaac79a853f5b3c8c9ea6901ff68e21516b9d595221ec6f842c10396a777

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 09b554688533144d735c12b81ec4a494
SHA1 64f012d1b25b4c9c33a9723a96e27ae0b07cf42c
SHA256 c6bd723fd852dc8af47c6798d7912f6395815f4a1fea1d2a02c6a8f3dc3889f1
SHA512 2cd9739cb0dfda3362763389a9a8e1a1be63b43435b02afec4c3038fd5ef5aac057d085dc9d51040a29a4a151987963ed7ba55800088ae0bafa9b583d5304142

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 1d1c7c7f0b54eb8ba4177f9e91af9dce
SHA1 2b0f0ceb9a374fec8258679c2a039fbce4aff396
SHA256 555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18
SHA512 4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 69743af098f9f7fa0256f5d319e2351e
SHA1 39dcf2774496dcc4e1c50833865ceda2b8d20dc5
SHA256 031d06f61d9b35c9de4a623c3ac69b077713cb2329bb7b9c0e8e2bbe9e417241
SHA512 3ddc5462d6ff46cb91260e46cf7dfd54c4cd51374341e0e004d5119beb63ab6f9527b99ed87254dcbe7c720163e38a6279f352788977af7e7a6f7d2488aba93a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ff4ec245a07fb800db0653ac69359154
SHA1 93f51937aca09c3482b98aed971d49bc7f0e1a8a
SHA256 5fc8fef49f7c75e5be8c1ebfa21a514fec5345a2536cd77b572e8aed17bd71d8
SHA512 ce21f639f15e9d8702c68c0014072df68f0c934fb1e2fa6c208bf159407db207043d4f5a52a64d3e88387d8b67935cce1515332db8a5757534f5966c159be7f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 1d5939959fd5425eedc8d05400ea166f
SHA1 14f8eb34ec6dbe38adc78c07e6a295cd930a3115
SHA256 0163d8821bc239ba19f310c00732e465b55c5a91287e473a23fd770b314e4bc2
SHA512 3a89e0ee2da559d37a96ebd0654f15da07a328fdc5de71a56d617952bb1709aee92409d5a7155b9ce97ff63cc2aff429de6e612de6650ed343b37bf80cda074c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58d53d.TMP

MD5 1dd845e522de4270bdd5c6cbf9bc744e
SHA1 6baf6bb8bbddfe01da53653961b49b1f03c3547a
SHA256 9f35f14a172c07254ce284e21e2bab6be721e2169888135e52e7a857c55201aa
SHA512 6b2e1ea29b5df79c0662a658b18cae68ceb5a15dbc542db86f053c79f9f5ee3d56a76f73804f9956432d0f06b82d7272b57729bacef70122bfac252af7706a5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6579571558eaa42822280caf5c5b8ff8
SHA1 28c09df40aef5bf1527cafc2fb4aeab62bfe2c40
SHA256 5657240698e019a60a95a0ca2a92b058b2186ac132c34496cf9c4e076d365c57
SHA512 16f601090ef4d6335548f5082155870594ed0f257c1d95950d9442e8625bb3ed4c59152e526a6254eb02b8503091eac501e3b7ec9712f14d82351e654b64dc8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593677.TMP

MD5 bcee8947beacd81784fbb444384c6caa
SHA1 c03c40ee80a31ee118cdd29b904fbef2a9e842ad
SHA256 5cd8545845f865c9757abd2db9409e8a887b9b16709602dd6faa0f205ab945f1
SHA512 b88c13bedda8c46e57b6d02b50118880cc054cb3db6fa4885048ec1b81bfb0af757e44d71ab6027631c87cd73ee43d1166a33ab4f3d55ce0765f48de724ac0fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a2af.TMP

MD5 80ab1d6628268eb369c693ba644ca1b2
SHA1 d8007ada75c8a6b60633c7ff4940d168012b7271
SHA256 d956621ebd5fa8f6a15f40c45fde00794ea2c0a3a8660db21ca55489c6c32cb0
SHA512 a20d530703a0e8a0d66ab30baa00d5c5d33c0a26e8c605b4683fde70c0ea74eb950b7331603fa5f5062705dfe9dcba66d246823907c1137018e4c97f992b3471

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 f3a5e6b08bbc2eab1634b23e762cdfc8
SHA1 81f3d2f5af963c536a78f0436b27b356a4d70f2d
SHA256 8a58488007ebd48fcbb38ea0e460e2aafd38e45389595b165f4325131087e1fc
SHA512 98aac279bb6da627aa42f35fabd0632d784907744d105c4859609a6d495482e325d4a4d86159b9133fa3c02d847cbc118b56cb13c98f0661f3abc68f556abf45

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d629525d1d7843b498631ffc83b3b623
SHA1 2c388edcb5cf03a6cbcaea0a0e641cf4a5762a3d
SHA256 e44afdf580e12f1054d51df6d36924f9f34af8caf31ff69985524e6a9b926496
SHA512 edc6339cd648f78834e4536916276fde568cda469973cdf8792bf8b2488edcf72078cbb4366a4b14975a92c0ab3df29685a4460db12b7ac42dc2bfbc0558de6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c5a3693c29882b5b3d717c3b6a825eb7
SHA1 44275c93da8dc45e5a76da0758d46e281d0f6c1a
SHA256 4d0910703b1f477239db6abe3ba240335f0917f6dcb5bbce77d47c2cc9e84d7e
SHA512 2d78e00b8c16f20b92a9ee00c2ec40e40a3dcab709d0edba913de3593e84f68ff7e37f1144b637962132256b55c1482d6c93df473c6034ad8418b1f053f278ab

memory/2692-845-0x0000000007FA0000-0x0000000007FBE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2863dc8733e01c241d5a2198a19ccc80
SHA1 46a2dd4a37e28b29522328c91bc3ffa4642ec9e2
SHA256 32da0c8464cbad08b6e3ed20a857ae67d02dbc35a79aac6a657b054c41ab605d
SHA512 07f3adc2f20a58c1f2cee167c3d2219f713d2212fb37123dcb2833ffe970c62523518a55aa3d623535484e10d36b9ec84165f3061c929b6d92856379c85db6bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 6c91d20cd774ad196f27ae498412b194
SHA1 c145dabc2b6f347015c9aa2ae142e14cf2a42c17
SHA256 2e2e11d7a45fa828c72ba292f862c4840fc29d980ef0715433d570c1ebf13fbc
SHA512 edc4d2c5776a1ddbdf757f746088a9cc03b3ed32d95a4aaca2df37d2b2e8b57821095e8a973794c25ea85b61163ed8b3d61f9d634f176834f99b111bbbf14ef5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\51da523c-0576-45a7-a417-52b4fbd7310a\index-dir\the-real-index~RFe5a1723.TMP

MD5 c708bf8dfc326ac7ff1f313b086c3dca
SHA1 8d8bb5ac049304235882e28e6ec686eb547b26ec
SHA256 2ed40e13c489daf457fa8c021c6a1b9d6e8f7083ea42128928c4e649aaa50b82
SHA512 7fcba609b96ea5c542a8030c8e92dbb7f175319a4f1f6091ecd456151e88ab6bd045cbc30a189f3e627d8c420dcf157488fbee0f287b0f6efe42dd15c20aa72b