crimsonrat | hxxps://github[.]com/Err0r-ICA/Ransomware

Analysis

max time kernel
110s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Err0r-ICA/Ransomware

Score

10^/10

crimsonrat rat

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023316-744.dat	family_crimsonrat
behavioral1/files/0x0007000000023316-752.dat	family_crimsonrat
behavioral1/files/0x0007000000023316-751.dat	family_crimsonrat
behavioral1/files/0x0007000000023316-781.dat	family_crimsonrat
behavioral1/files/0x0007000000023316-798.dat	family_crimsonrat
behavioral1/files/0x0007000000023316-809.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Executes dropped EXE 8 IoCs

pid	Process
5648	CrimsonRAT.exe
2412	dlrarhsiva.exe
4568	CrimsonRAT.exe
3784	dlrarhsiva.exe
5472	CrimsonRAT.exe
3756	dlrarhsiva.exe
4944	CrimsonRAT.exe
5312	dlrarhsiva.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
41	camo.githubusercontent.com
37	camo.githubusercontent.com
40	camo.githubusercontent.com
44	camo.githubusercontent.com
45	camo.githubusercontent.com
134	raw.githubusercontent.com
135	raw.githubusercontent.com
42	camo.githubusercontent.com
43	camo.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{D1D69AA5-45B1-4304-A739-1F098867720D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 781923.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
4412	msedge.exe
4412	msedge.exe
1064	identity_helper.exe
1064	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
1392	msedge.exe
1392	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5732	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe
5732	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4460	4412	msedge.exe	87
PID 4412 wrote to memory of 4460	4412	msedge.exe	87
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 4368	4412	msedge.exe	88
PID 4412 wrote to memory of 1004	4412	msedge.exe	89
PID 4412 wrote to memory of 1004	4412	msedge.exe	89
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90
PID 4412 wrote to memory of 4248	4412	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Err0r-ICA/Ransomware
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffad6d046f8,0x7ffad6d04708,0x7ffad6d04718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,8630941202253841286,15374111340680611557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5648
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6076

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4568
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:3784

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5472
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:3756

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4944
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:5312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
2.1MB

MD5
92a423b6be1b405186edd105599d0dcd

SHA1
2c0dd34175fca6632502898eac54bcca67f989fa

SHA256
c7388f43dad385a85d7a2ee4591c1f401ef46e7766e0f3df474ccc122812c6eb

SHA512
f6211f4896d18267ae833d9c11eac7a0efd6725f1e8fb34402754941901d666773d4815de611a7df3257d5794b978a9219c8e818d4491ec6ddbac08458a96c1c

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
256KB

MD5
6f4ce7509cee19f4be00c9ac90a821f3

SHA1
9625eb9e77ec2a4863ddca5955d8bd44b4d31146

SHA256
4f053000430067843df18519fb4050108b4ed03f5757ff9bcdf6e79579b3c1f9

SHA512
7f3f6f287dc60a0aa423f0033ace65ba30570d02294efb256f4e574373a4962151797b3fff1e8db64b5729608e9846faf83b07188629ca4e4eaae231008d7925

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
260KB

MD5
e4a0fa4325c93e04d00e4c6a5604b6ab

SHA1
c1017956971e09265257773c8d2c30433c4ec459

SHA256
961354489c560a37b78f92d990af9dfb58c0d776a60df1d67e07c3daf05a88f5

SHA512
dcea1a3745f0f13e63c256800e0738f265f25a0a332bd5a0cd06a1860a4c22ad8bcb1f16184851ff41d8ccd5b330835d320b3cbc2a5ea723a72b88b2197b8908

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
807KB

MD5
5c488659d6a05217b935ee9b9e1348d7

SHA1
261821085861801b319e4cb2dbf629043570fe40

SHA256
a17cc25743a19bdda15dcb52e7377d577430d30119c459ae41f7ada63d42a24c

SHA512
a63aef78bd62f44799bdce2c3d2b3fe9638021fdf5e08cb22c507410b28366d571b34c88e8f06582089afb1c1d0093bfd5449e27452ba0c07d4556253304766f

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
6.5MB

MD5
fd4b5f6d27e033cf5d7a01b1270717d0

SHA1
2f4ac0144fbc834b48712a0fe91da95e536ea838

SHA256
e5bfbff85fe8a823945f5a04c89abab42ed6d3bb4918f47dfb58f8715199506f

SHA512
f121a7998cdf04442be884621590981b598155cd925ef3fc428e95566887d991888468ad226b777dfadad3c57eaf6ca86aa94f99d18e39b116216cf5026b39cd

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
2.5MB

MD5
62c79b836a4e5c33814d2487d0355dad

SHA1
30353b5729529d6387e8f59cfd63738dd2e030f6

SHA256
41ffa8bacd232de329976e328660523a9b0efd6a4fff932f37bf724bb3d8a04c

SHA512
1bda6d22ebb230e0960c77322d7b3bd7895a2da6a2fc76b544a10d4661ce51d66de0884d968a5ae0e7dc8bae09394cb461b434e324b0fec93b16634d3fc4c393

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5838227fe19aac55e94996f9b1ee06cc

SHA1
53b7635b284f299b916f4b402f0eff092cf69c3a

SHA256
0456e18731be24feb75d1faf3addcf0ad0b917441e48ea3a02fa4169d3f06e0d

SHA512
f45e1b8c788a3d9ef52bd2cee57223eb0f1a106f094bf7fd51758935f68d171769b0632b791a925e30e8a926507f230f52271fc24bcd47b461912db8b55b8d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3920d21dae7efc41954fc35d355663de

SHA1
889c60922619202fbf18d580e526f87b3af57d03

SHA256
3dc058579d5936c9a7f6d5d90de26cc3a6e532e5351302ecccb0df5b4dd8509f

SHA512
130f6bdec62ec89105dd7c06fc8bd40a446ff7ec6dd1e8f066d0a3ed345b50a8c6de885b307a33191f858dcb45dfee9609ca8e21a1f2ad5e99550035fc0c0721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0e1d67afa77a0ee02e26647b35371346

SHA1
cb04f54aa3d0de7b5ea2597426a13e48f281378e

SHA256
d55615bba05937b2c489a9d66dd60b426d804aae5b9228537c6647cd9e0dcddf

SHA512
935ba1f28b0006e882f6ff6dba13a4f3365d93240f75bc96813add7064892e2e25bfe1094c0de1e26fedd863fb07046405f36c06e08eea69642003da359d54ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e285197ed9cb2f1c788ef282e0852735

SHA1
6581adf68f102f57766cefb352fe0cd8906bad45

SHA256
f59885617dfe5953fd3f039be9fc7e0e68545d8f563a358e4719eb81338dd970

SHA512
a206c7f1c254b510672ce72597ffcd33025247cf9db89975afb663a38e0f86ad81a7c01877746f0aa9d8bf0f3593bc8c0e42d5543a4f04be5e97195686c1b1ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcb4e58c5a06a45bb4c3079b96d63ff3

SHA1
a1fd12df9b5477048bd631503812c4108b0f8719

SHA256
0c5226468ddb5443d387051fbe6e36f3b75b8529c8df73efa2f0f42b3229e95e

SHA512
eaacfe6ab7d4ab312be55bc11445024bad64359b4cd4027f84c431f11d74faf17e256541b5a11f2ec78333c1bc0305263b399fbb486b8be753a7d1982aa1d519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cdffd00a23a512e066fb07f42e4db48

SHA1
eb9d5e8356c88be38d178dbe85a3d64e7b3413d7

SHA256
7d543e2291da9d293b20b58f6bc24e7f358e543d9f47d4aa2604803b0c988779

SHA512
79f19bb61281c0629b0826a7ca39e6655d5130a1c58252474ba1c374d7ef682415869819fa05543e7cc2788e185bf3510fef69456b96bd7b4272443d6ec5e43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0bf9c9f2a440ff3bfb588faf730c9853

SHA1
3545d441d7f804ceadcf1213d6b8a34d987578d4

SHA256
b9afd13031231de4866be45bce49b9fc05050980448744ff81fc0b1c0bfdfdd3

SHA512
3dcd16207c88499cff1ad81dbc0262a4964e0196407daacab75bcc23ff7ab94682f4cf0fa7014dd11e1e22ec2cc9d2560b015c2f1f2d1279b4329ac0abe78e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86058bafc092a2fc848029268fa63122

SHA1
37a3eebd961bd39d31bae24a86988dffcca23b65

SHA256
dca3a85bded1ebfdaf45d52c0ab22c89c63a02196ee11969b2e0e639977a0c18

SHA512
6bd49fcf59050a9841bbcec654a46ee59fe252f5fc7bdfa684917a6ad7df024490369e72172762274bea7d52e23cfc0cc1a06e574386a42e74e4b221721226f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75453546a9e6f2a0278fa15f0d37f883

SHA1
d031a00f2ed06745d185e29e0a7fb057f368dbaf

SHA256
c6032056f76eb67c3cde946d89a58455a2925a27a1ae6ed1e848268bfd4ae026

SHA512
59383a95f5e2ab137c7b915e3a2a3b1138097cfb767f3c4e0d7585d428df83617b75749f0b34b318888312eea57ff6b475d14c9fc68c3302ef52ad627fd74dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0ead8bc2d4459dc47a321afbc78d505

SHA1
ba54be9605b2e7729419af1e38f78648d4eac15b

SHA256
c89654e68a0ad14271866f1e794c88a1fab59cb225aef649f9cefd81df8c1280

SHA512
9c5c790d5f122ed76e0bd972a91006362ba63ad7dda3881bd1531392972f4a40c694628785db5be94a223a90f2329617c523562b995ddb8d72ac75142de99381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1444929641b8113fbc9f5934a4b14102

SHA1
0942c45de390a11cd13ef97ed2578cbe24ab118a

SHA256
629414b9d6c97544b428506e8cce5e3bebb518d646431b169aa1ffdfc62f537d

SHA512
0dc5600190cc4329298285676b2aeefe54a2bb3d69a8d5bf40aa5dc87292e97b37e958f778c96c3fa223702c41112c4f4c6290d6be452a58df154bdb7ca35a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e6ad93fda0f5fefa29d8dcc1d4ea4a3a

SHA1
da2d476362540dd7e2d30926cde2c5bc4ae6d2fe

SHA256
b510deb83e3288fac18d457bf7e441c9e73727b7cda410be632e620fadfc1d89

SHA512
703a12c4e128a8223ee97b2e912b6fb2b18bfbfb2bbfedb3dac823926e4f20c8a7e1d16f9483e3d70bddd4f6b8a9c1f8f168e4300ba05c475859ae6797b5848b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c63e.TMP

Filesize
1KB

MD5
704936e32efaa780abdb57eb61a53071

SHA1
766abd6e97eff0dc037fa848c77a1403ada054cd

SHA256
60849d4062a18d0f9c9988c708174500de74db484b86e8609603b78d3b9fcf54

SHA512
a8f1b30b5d564ac178e352faf7e91af659daf2860d2bd03ebf8dcc53d0dd3970679d0b81300418d48ed404a8a1f38f22997932b72a3fb462a526b0010706d4ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
00d1325ab3742b578ace8c1155a53028

SHA1
8ba1e87accc34b3b63fa9afb012bbeda910567c0

SHA256
17519e319f17b835db6ffbfa7cd2ad1bfe4a59fc9f89d471ed01710f066e3f4e

SHA512
42d6a6c95e878e9987b2bb478db1e2284bb35f9bf95646475d1cc5469aad409d1dfc5056f9660a7253a4e139baab448763570992c081b734c376918f874223db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7a57d1c6e92ff57ff2ad1cd93984224a

SHA1
4d5cedef6cdcfae08ec3a0a958abbdfed3b24fa9

SHA256
4f6144f5d47ce90ad89c686e87f5940df82e6c64751a88dd7befbba66e26c2da

SHA512
659eb8830b6a8f86eaffd510cee3f0ef3a96229fac4dbbc27b448b8dc402a18bba03aca3ca440201e706c30a6378b5097f73e44b58d335b0fd0571709c463a91

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 216072.crdownload

Filesize
12.9MB

MD5
fbe4bb6ec3dd8332e9edb0e74c3136b6

SHA1
43e8076cbc4729f0052e5bb62ac02c7720a97b61

SHA256
8435c51115f7517e00f8d016ed41ba9182fa75a9d549bd67fbaf8ae2b68dd91d

SHA512
4f5c1ba196e2e00f918351f8a687a12a4b54ab77534d34dc7e0df7b4872c8a2032610a230e501af863c68f93a906d2b8a00c10d5ba95e4d5756c8c0a44771abe

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 781923.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
memory/2412-757-0x00000250C7600000-0x00000250C7610000-memory.dmp

Filesize
64KB

Download
memory/2412-754-0x00000250AC6F0000-0x00000250AD004000-memory.dmp

Filesize
9.1MB

Download
memory/2412-753-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/2412-801-0x00000250C7600000-0x00000250C7610000-memory.dmp

Filesize
64KB

Download
memory/2412-799-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/3756-802-0x000001B82C170000-0x000001B82C180000-memory.dmp

Filesize
64KB

Download
memory/3756-800-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/3756-824-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/3756-825-0x000001B82C170000-0x000001B82C180000-memory.dmp

Filesize
64KB

Download
memory/3784-782-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/3784-810-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/3784-812-0x0000017DA7C10000-0x0000017DA7C20000-memory.dmp

Filesize
64KB

Download
memory/4568-778-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/4568-783-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/4568-779-0x00000195E8500000-0x00000195E8510000-memory.dmp

Filesize
64KB

Download
memory/4944-814-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/4944-805-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/4944-806-0x000001DCFD320000-0x000001DCFD330000-memory.dmp

Filesize
64KB

Download
memory/5312-813-0x000002147F570000-0x000002147F580000-memory.dmp

Filesize
64KB

Download
memory/5312-811-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/5472-794-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/5472-803-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/5472-795-0x000001AAA86E0000-0x000001AAA86F0000-memory.dmp

Filesize
64KB

Download
memory/5648-721-0x0000024F26930000-0x0000024F26940000-memory.dmp

Filesize
64KB

Download
memory/5648-756-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/5648-720-0x00007FFAC3290000-0x00007FFAC3D51000-memory.dmp

Filesize
10.8MB

Download
memory/5648-719-0x0000024F24CC0000-0x0000024F24CDE000-memory.dmp

Filesize
120KB

Download