Malware Analysis Report

2025-01-02 12:12

Sample ID 240418-1tk41agh9x
Target https://pastebin.com/raw/z5PQ82wE
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://pastebin.com/raw/z5PQ82wE was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Async RAT payload

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Delays execution with timeout.exe

Enumerates system info in registry

NTFS ADS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-18 21:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-18 21:56

Reported

2024-04-18 21:58

Platform

win11-20240412-en

Max time kernel

108s

Max time network

110s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/z5PQ82wE

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3676 wrote to memory of 2036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 2036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 4560 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 4560 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3676 wrote to memory of 1356 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/raw/z5PQ82wE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe43423cb8,0x7ffe43423cc8,0x7ffe43423cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2574917507284470361,5637141313155935432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6712 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\ReadMe.txt

C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe

"C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17\VantaFN.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF141.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 23.62.61.129:443 www.bing.com tcp
NL 23.62.61.129:443 www.bing.com tcp
US 104.21.43.48:80 sentryhub.cloud tcp
US 104.21.43.48:80 sentryhub.cloud tcp
US 104.21.43.48:443 sentryhub.cloud tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 172.66.46.224:443 cdn.sell.app tcp
US 172.66.46.224:443 cdn.sell.app tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
NL 23.63.101.170:80 apps.identrust.com tcp
US 172.67.72.62:443 storage.sell.app tcp
PL 83.168.108.85:443 jpcdn.it tcp
PL 83.168.108.85:443 jpcdn.it tcp
PL 83.168.108.85:443 jpcdn.it tcp
PL 83.168.108.85:443 jpcdn.it tcp
PL 83.168.108.85:443 jpcdn.it tcp
PL 83.168.108.85:443 jpcdn.it tcp
US 104.26.12.122:443 storage.sell.app tcp
US 172.67.72.62:443 storage.sell.app tcp
US 104.21.234.235:443 rsms.me tcp
GB 18.172.155.36:443 d1ocs0c2k933n1.cloudfront.net tcp
GB 18.172.155.36:443 d1ocs0c2k933n1.cloudfront.net tcp
GB 18.172.155.36:443 d1ocs0c2k933n1.cloudfront.net tcp
US 104.21.234.235:443 rsms.me tcp
US 104.26.13.122:443 storage.sell.app tcp
US 104.26.13.122:443 storage.sell.app tcp
US 104.18.8.90:443 sell-production.7bca50a0c064d476bbd1b6bdb43135ad.r2.cloudflarestorage.com tcp
US 104.18.8.90:443 sell-production.7bca50a0c064d476bbd1b6bdb43135ad.r2.cloudflarestorage.com tcp
US 104.20.3.235:443 pastebin.com tcp
DE 2.58.95.128:7000 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 696ffba7b83ecf008523e96918f200d9
SHA1 970d90e22c8b3674fc33cdd1913c51ef28514255
SHA256 dc6dacd725d7385b2e4db1f488d93f2840d2289efdaaf3737849304d1ab9ba34
SHA512 f8528683b70b58376f3eba3338fa6b462c9e9248c72524573005cff6397a0556bdcc2fdc2ebb020ba8218bc8174ba552002f223a245dfe3d3688826d24d63237

\??\pipe\LOCAL\crashpad_3676_KIRYPJLOUYTMZWDK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 54caf18c2cda579e0dad6a9fc5179562
SHA1 357d25de14903392900d034e37f5918b522e17c9
SHA256 28d77529de92eb605d8afee0e133a7d08e13d4386e5e38d63e2da34623eaad6b
SHA512 88da5a33df9d82408afb8344ec7dbaf7686435fdb55eccfb85d5560f39861e84cef5d71949d5efe7a191778e6be755a8448f3fc3d7043007037f9f5227e10210

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f3f45cce1062368cc8026e986c33544a
SHA1 ef63fa75aa4832d410cf2a55b8297ea519ddbc50
SHA256 10d92dbc38e50d9efabd635b12f2616e8f3b32b04758381f4cf5eff03d4ec7ea
SHA512 b643df611c61f78b35c0b0ddb81c309d92ab5aea075c10fba8ad935de47270c211d539c764e6ce905d333e03bc0f9ac5da0ecf379302c382fea38513c9bd36a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e41439b335f9ab9d68f23ab3087db914
SHA1 dafb3ac8f3400597846c277cdc3cc2189f295d27
SHA256 51d6bd0191e2ea40b05cb91058048711d17dfb420dbf71f180ede75b12ff5200
SHA512 a7eb9e89a3c3f7bba1fd9264cb5be117fb4b3b6f39dced90dd1eb6ad3ae8654d96fc9cd74a952a3848306f9e9caa79ad9b1d71da9d261fece01e2f9bec462ecf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cff735a14a4b534ce28f73e9befddd49
SHA1 3e07e2e4bfe8eb162201cb1a426458c55db51694
SHA256 55bf566aa7f6d62c86df66c2137e5d45f750da055822ec3074ee0b89b1480d41
SHA512 ffa02b56540902109e2e3c3ca7487f52853e9bfecdb3f6346bfa731a8dadc79692364aa7d5feb0dc2f6a80b6ee6d140806008fe45e3c86f1d859b642cb70ff1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 10b67a0688a42185fee5491ef7ee1920
SHA1 d008a50c2ea1c4532d728725793650fc8cc257ac
SHA256 3679f3fad60781263760cad4455cd6568f8176e234c019d6c0de642c0d4755bc
SHA512 5c3ff51e26952f5cb5d76c229a1c3dd4fe2cdab4ec50109a6c0e128e7ed4ab0c502cc806f22eafc8776f78cc54080e89a0300a8fb65f2b30e3449a67888cb75b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 192cde6121b6216eade9508b95b55ede
SHA1 c7bd2f04f503d4faedbda867832da37a8890a5ee
SHA256 35f857f0571da6a70db93fe53046efe095de7793631da2f894a3da7809697880
SHA512 fb534f2343477e467534fe8062c13e2097fcc6ee85d122644b367657a91523aa76b542eeed2a08adba372010db376bf9803a679307e70c3f59775598be723545

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9f51514f62edc2c2c9e8f98343b3eef4
SHA1 f9969551df9fcd75647e87412ca5f8323d4b5a5f
SHA256 525ad63c61c09a2adabfa61ce31a967ee91d47534cdec85dc960b3686e824335
SHA512 0e13c52bcbc6bd1d69426a62c4fce99bfb03ddc1102ec3169bd91876c80207b71135316455de77e4bed835029ada974448b9a89e80c1761ff84410bf7d394991

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 877812bfdb27d72803eaa61a49ab2895
SHA1 367256f1c68c0f9828b4cf4276365877bc30f579
SHA256 d76a6f063b4a2a00c6b7f0eaf06445eff013bc40238060a491d54af7ba2017ed
SHA512 e05b3b3186c0284b577a0f7aa2fbcd99b8d462e037c21d1d231f4d4c2e931fbd26438f0c084ab1b528f85d2724cd4c0f810813a90b36adcb42907cc73d505117

C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip

MD5 194c188093dcc132a8deea7b0dad1f2c
SHA1 d52b99d85b91aa1fbdfe4afbb25d099539108380
SHA256 83d1269b87125006ff08fd7d99a1e5b1fd62e9769848d9912853f4e56cb6ebff
SHA512 dbb761c7e3210103ffd9aa1bf3c95eec5dcb47bcb8532635c3d4ebe5e0ca40e0f4e5e53cad880f5253b4009ef4bdc162be2c0545a95692beaef2840aa522c220

C:\Users\Admin\Downloads\TPSPoxR1tjvrw3nqDARFwixDWzQkPxHBxmBosA17.zip:Zone.Identifier

MD5 6e3ce466f52191e4ace5cf6ecfd8e482
SHA1 f59d9d211ea377db251dbf7a0f2195f36937641c
SHA256 f95477b575a7930cb6f7b17ae486213e8a7755accc5183f353aed023918df162
SHA512 9ced645867d2bbd088ebbef807da1906f2d0d9f5736525486c7c0d101e322b0d7bf83b8130877d84c401668d0cd0840515af79086230d2327d030ca4d513fd8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 096ec21d552ecd7fca2f8ab581e38764
SHA1 b288e5292064b2bf008c3335c9afc260e4fcfdc2
SHA256 bfdbd305fd16b87a4d8bc192e7f6978341bdf06f37884e669bb8112ce1b3bf09
SHA512 2c167603f1721a4b67cbe6000bbef1e1ec106aa2111eb7ecab6f8415d9b785e4d11b12816d3a4ac9877d1e040c02e281c655059c314b76b17e0109f59c42912c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589f48.TMP

MD5 c7ae2c408b971f76460d2692ccebc5ff
SHA1 9050d34155d6e2b6878106e635fafd9f80efaebd
SHA256 c491aaa523c70e3db24773bfc8e2e5ade1becd747a3ee746e20ede4cea919f26
SHA512 61915c41a52d8776953c433b70f815c5fb52acf5ff04ad98cb918f05e7bd143408c299c64bded3a5138be20f2e39c3df8eaa64f34be27cfc7d1d75ee639de7ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2a98e238ce425b7fa489e0ce245958a9
SHA1 e6b1d2151892bcb426f6d8199b01f0e2f67e4796
SHA256 8a2a055d10294ffbe1fdbc4ab117c60a3149ec0285db7ddda18fae234467db77
SHA512 b4e596f1d4b23f857af11162767ea513c4f1f13d84d74914eee55636b611128dfe4b0e7170feddbcec16c38880a2bff2e511879e5dea9a9fc3ee6233aabfeac0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a2bb909b456cd88976442724cd237ff3
SHA1 3b862ae1a27241af24dd106d7b0e86217ed68a68
SHA256 1dab615e47096fa4b4a0a64f0d1dabefc984d7a0ca6c5547eba5a58d03253e0f
SHA512 9ee6c6d7ee7b8db683dfe769806be0591a44282b474f308d053ee0ee124ba65db0332dd2db40f0420d2ea5a801861650734e6699738a602484694abc12dbee4c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6a193dcc4de626c02fcc8ffc01dc2328
SHA1 1afcb0f95269f4b3d6c17d3fc62542b55397e3bf
SHA256 89b802b15cc8f486a4ec7b9645a2bf8316fddb3a6aba74cbfda5e89e5145935a
SHA512 5db8ef9d273218ded606f4d1332d72da42dfd458f4732cd9ea2de17f1c39e83c27c64ffef33eee48fdf963349a9b1ff1e49af0ff843a87aa4c861f7796ea27ee

memory/996-352-0x00000000000B0000-0x00000000000C6000-memory.dmp

memory/996-353-0x00007FFE2E520000-0x00007FFE2EFE2000-memory.dmp

memory/996-354-0x000000001AEE0000-0x000000001AEF0000-memory.dmp

memory/996-355-0x00007FFE52440000-0x00007FFE52649000-memory.dmp

memory/996-361-0x00007FFE2E520000-0x00007FFE2EFE2000-memory.dmp

memory/996-362-0x00007FFE52440000-0x00007FFE52649000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF141.tmp.bat

MD5 5e9dcdb4931baf91c93765617f283997
SHA1 e2b1043b30b88c8ccd248f254bd516c55313b96f
SHA256 6332bf29fa1e7ba04623f4813925abd757d68f30e9eed2a71c9a3ad111d989b4
SHA512 207fa00998ec756b1ca0b5d16caf55c13b6dcbf083fce884baf37fd28fdbbca3625553fb1f1a09b3ee4632955432a04fc5eb7358539135266fb00c725a758cd2

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 84699018b1132b73d8063290faa07789
SHA1 7d1eec5ae60f0a0383f723f1e001dfc6c2c76aac
SHA256 d35c91227f48c494930749f5486054244686328ad8e02960a6b0b10226bc174c
SHA512 d7d29eaeacb5d4289aa0a3bbdf071f2e875bf307e326829432cfbbcff1b19e3eaccfc81ec5ebcbf2beab7dee8aff05ad8c086ac0e61a0837339f4febabef5ade

memory/1264-366-0x00007FFE2E640000-0x00007FFE2F102000-memory.dmp

memory/1264-367-0x00007FFE52440000-0x00007FFE52649000-memory.dmp