crimsonrat | hxxp://bing[.]com

Analysis

max time kernel
250s
max time network
250s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bing.com

Score

10^/10

crimsonrat discovery rat

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x00090000000235b3-793.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Executes dropped EXE 10 IoCs

Processes:

CrimsonRAT.exeCrimsonRAT.exedlrarhsiva.exedlrarhsiva.exeCrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exedlrarhsiva.exe

pid	Process
3936	CrimsonRAT.exe
540	CrimsonRAT.exe
1784	dlrarhsiva.exe
2908	dlrarhsiva.exe
1388	CrimsonRAT.exe
5052	dlrarhsiva.exe
4060	CrimsonRAT.exe
976	dlrarhsiva.exe
4896	CrimsonRAT.exe
1280	dlrarhsiva.exe

Loads dropped DLL 8 IoCs

Processes:

MsiExec.exe

pid	Process
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
150	raw.githubusercontent.com
151	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{43833C25-D184-4F0C-A411-AED4A60B9021}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 487497.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 689278.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	Process
4820	msedge.exe
4820	msedge.exe
412	msedge.exe
412	msedge.exe
3256	identity_helper.exe
3256	identity_helper.exe
928	msedge.exe
928	msedge.exe
180	msedge.exe
180	msedge.exe
540	msedge.exe
540	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4660	msedge.exe
4660	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

Processes:

msedge.exe

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	4876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4488	msiexec.exe
Token: SeCreateTokenPrivilege	4876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4876	msiexec.exe
Token: SeLockMemoryPrivilege	4876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4876	msiexec.exe
Token: SeMachineAccountPrivilege	4876	msiexec.exe
Token: SeTcbPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeLoadDriverPrivilege	4876	msiexec.exe
Token: SeSystemProfilePrivilege	4876	msiexec.exe
Token: SeSystemtimePrivilege	4876	msiexec.exe
Token: SeProfSingleProcessPrivilege	4876	msiexec.exe
Token: SeIncBasePriorityPrivilege	4876	msiexec.exe
Token: SeCreatePagefilePrivilege	4876	msiexec.exe
Token: SeCreatePermanentPrivilege	4876	msiexec.exe
Token: SeBackupPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeShutdownPrivilege	4876	msiexec.exe
Token: SeDebugPrivilege	4876	msiexec.exe
Token: SeAuditPrivilege	4876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4876	msiexec.exe
Token: SeChangeNotifyPrivilege	4876	msiexec.exe
Token: SeRemoteShutdownPrivilege	4876	msiexec.exe
Token: SeUndockPrivilege	4876	msiexec.exe
Token: SeSyncAgentPrivilege	4876	msiexec.exe
Token: SeEnableDelegationPrivilege	4876	msiexec.exe
Token: SeManageVolumePrivilege	4876	msiexec.exe
Token: SeImpersonatePrivilege	4876	msiexec.exe
Token: SeCreateGlobalPrivilege	4876	msiexec.exe
Token: SeCreateTokenPrivilege	4876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4876	msiexec.exe
Token: SeLockMemoryPrivilege	4876	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4876	msiexec.exe
Token: SeMachineAccountPrivilege	4876	msiexec.exe
Token: SeTcbPrivilege	4876	msiexec.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeTakeOwnershipPrivilege	4876	msiexec.exe
Token: SeLoadDriverPrivilege	4876	msiexec.exe
Token: SeSystemProfilePrivilege	4876	msiexec.exe
Token: SeSystemtimePrivilege	4876	msiexec.exe
Token: SeProfSingleProcessPrivilege	4876	msiexec.exe
Token: SeIncBasePriorityPrivilege	4876	msiexec.exe
Token: SeCreatePagefilePrivilege	4876	msiexec.exe
Token: SeCreatePermanentPrivilege	4876	msiexec.exe
Token: SeBackupPrivilege	4876	msiexec.exe
Token: SeRestorePrivilege	4876	msiexec.exe
Token: SeShutdownPrivilege	4876	msiexec.exe
Token: SeDebugPrivilege	4876	msiexec.exe
Token: SeAuditPrivilege	4876	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4876	msiexec.exe
Token: SeChangeNotifyPrivilege	4876	msiexec.exe
Token: SeRemoteShutdownPrivilege	4876	msiexec.exe
Token: SeUndockPrivilege	4876	msiexec.exe
Token: SeSyncAgentPrivilege	4876	msiexec.exe
Token: SeEnableDelegationPrivilege	4876	msiexec.exe
Token: SeManageVolumePrivilege	4876	msiexec.exe
Token: SeImpersonatePrivilege	4876	msiexec.exe
Token: SeCreateGlobalPrivilege	4876	msiexec.exe
Token: SeCreateTokenPrivilege	4876	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4876	msiexec.exe
Token: SeLockMemoryPrivilege	4876	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

Processes:

msedge.exe

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Grand Theft Auto VI.exe

pid	Process
4148	Grand Theft Auto VI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 412 wrote to memory of 3124	412	msedge.exe	82
PID 412 wrote to memory of 3124	412	msedge.exe	82
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 5112	412	msedge.exe	84
PID 412 wrote to memory of 4820	412	msedge.exe	85
PID 412 wrote to memory of 4820	412	msedge.exe	85
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86
PID 412 wrote to memory of 1392	412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bing.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab63a46f8,0x7ffab63a4708,0x7ffab63a4718
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\BabylonClient12.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3936
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1784
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:540
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2908
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1388
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5052
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4060
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\GTA 6 LEAKED!!11111.jar"
  2⤵
  PID:2764
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\GTA 6 LEAKED!!11111.jar"
  2⤵
  PID:4748
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\GTA 6 LEAKED!!11111.jar"
  2⤵
  PID:1008
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\GTA 6 LEAKED!!11111.jar"
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4036773543526659448,7516919210174556199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5E0A370D189E549B87F4564BCC0D5AE3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3552

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4896
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Users\Admin\Downloads\GTA VI Alpha 0.1\Grand Theft Auto VI.exe
"C:\Users\Admin\Downloads\GTA VI Alpha 0.1\Grand Theft Auto VI.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4148
- C:\Users\Admin\Downloads\GTA VI Alpha 0.1\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\GTA VI Alpha 0.1\UnityCrashHandler64.exe" --attach 4148 2144449990656
  2⤵
  PID:1688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4bc
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2E76130AF11138F39D76E0D756C0740A

Filesize
727B

MD5
a55161d726a4cb967f952ebcf1ae18ac

SHA1
f34630d3944adc49d2908991ee6e437b7dc4f2b3

SHA256
ae6594a7c997c81e56b378e8c6e597f7034478e153a5e6945b7173e72d90940b

SHA512
c87f28bdc64a49475b03be040f1d0925300bfecd50de17f27ea59f7261d1e8ecbfe29fe4949dffd5a804a6790e8d0e39e4cc03d41b0d9280d388ce836ebd3f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
519f47ca386a53c372d32c745e3ff3d3

SHA1
38299d39d43b29c8145af347e59e11d233ec225c

SHA256
1cc9a63b647ec23c31782940811afce8f2f9c9cf1a54172c63a308b109051e23

SHA512
9755bb085c54b749efd6d235fae12064e585641ff10751af4c26f861b590868480d19e17a4784a7548cf09f72c9e654186f687f1a569cd885f4dc7c48eb424d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2E76130AF11138F39D76E0D756C0740A

Filesize
404B

MD5
469270cd7931af71681dfe55083979bb

SHA1
2fd2b56e35542a812d0394fdcab855a9993f1cb4

SHA256
46fcd4f695e14aa86b5cafdf4c50985c76b527ad85c68c7d8149d15735d59b36

SHA512
4a6ff2d819e1df2c69d40c2e458b7af0b38983c7d4497ee5b1ebeaac458eee4fad92dc59b8a6c68e492bc3958c68ecf7a4fde93d602ba0fca2f66b87cef6b5fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
d5bffa03de9e208bb36b9bb2e777e866

SHA1
9ae02510bb0cf5c2ba6a4e41bda95ea9b34a98b5

SHA256
0dab1d4c4c3ebb41f01a67892f14d49ef84656778fcc961b41d3352b54352ff0

SHA512
bf4fb84c69c201a18cbadbcf29b63dc29e201682121286189c7a551bfea28a284d52708f0b30a6423ff52cf6b6605d24df3fd75d8d552c6ae443232b229e0737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
80KB

MD5
63cb33954457f26626588dee019f0628

SHA1
e2b77e349e8f3486111a399ac12cc535f847d829

SHA256
56fe192e0c1fd80583e6836ec062edfd106733faa53dce88d819bdff4f793ab0

SHA512
8a10ee66a545a62c427dfde58c52cce1209ac0069cf43bbc9492a5a5f52530dbff1d3468ddf699f8341fe3b35d11f75912ed73bb7cbf682bf69b970a3b37d198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
43KB

MD5
790c81db9bf945fc2a3a3912c2a5b6ae

SHA1
bcaeed70f5e969e369dd2303df53da089a81bb8b

SHA256
5dd15e15b2c3f3537c06e593e5700225dd28f13678e9649866c7d3c477efaba4

SHA512
7693db525ca06118bc1907e9962ba691f1973bf5639986cb303c03894440dfb9252a2e9633d5bfff58905f8b0fd9dd63d75b48991412ccc4f0277127a08365d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
50KB

MD5
258e004ecafda290f6007fbfcbefeac5

SHA1
ceb03d36597c7f77e68b4c85dc659678cebce4ac

SHA256
745bbee63267b68f0c10253ab0cb56e8e706ce1ad401e37ec0f198f0772211e8

SHA512
4af726fdc5a36e2f0a6b9ae30f54399e69051527a2a9732cd19115f08a5bb3db0d6473abcce2015bebcf2b3cc7e34585adc339a9b16de5d2f7abbbbac4aa9990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
22KB

MD5
8edeb5a220fe2ebde6e724ec46a47b01

SHA1
4cda11549a4866dda172d7e9eda415ce3f84fa3c

SHA256
25426e5097ffb53fe93f88b9e6fd457aece2c01ae06c9cc02aa6d0f59e04b7a3

SHA512
279187e4788378c7b27a7d606293622be31423a76a749d9ae03c2b359b91482f937c466b1288545f8d2251b8df306ada2c30ba5d1d186b63946aa42327000118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
21KB

MD5
365139c81098a7d1a09be5ad35636cc9

SHA1
1ea3cc8cd2e4af315129ad24f4788e7b5ae48b74

SHA256
a8afb3784cafc474c077c92a5e640ad01bb8b8ddfec1db4908e9291fa3d48ba1

SHA512
1934dff330d81f0b576522350f655bfcfb10d4dea9b23b4a0c7581ade4044d7c8a81e62caf5c3ab1009fc1bf99d083ddfdd2c1a17f748a1566320868db1516eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

Filesize
22KB

MD5
cae0a3bff6c55245d9c41f31ffb59d80

SHA1
ebd40dab223720af9a3f7f6fd8a1d979a50ffa92

SHA256
0373c3d6ccd255a22794c4d134d7072a5eec32cd132571889538389959075abe

SHA512
f0fd812b0c5db1655a224729c1d2f8bca5dbd797f333ddeb4c8779a0c7db7e142f02bbbb209971ba324613bd6c467f2dde4f940c246236752cf47e9c53fc73e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
56KB

MD5
55b15c8043b4369c5fdaca9d818b4ff1

SHA1
c87dbd43c5f5df463797f83235a32caadb5f76ed

SHA256
f4d6b22a34f816be37c677a6a928671b27350f5cf02d0dd65143cb9b130418af

SHA512
a22fb2e6d847951ace05ad5487abdb7ec00d537bd1cc4f70c2a05bdb7168398257e1967521bb60d0f7f230f49a335cfe718c077e7dea91292cf4d027289223fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
93KB

MD5
3459562ff3e73626e3ca534711f2090a

SHA1
0d539aaa728052ccbd8a6edf4c538f6b6aca0a06

SHA256
7bef8a9b82ea3d7c1dd6fe85c9a38c92dacabd6586204ccb7437cfe3c8d101f2

SHA512
10ac00eaf4aafa7b414391cfedcb8fbdb5cf9729cada2040e1420f85b979253fc484630a2d62e57cc7d13fdafd5a5950f5d98da6341429ba774996ba50cc5387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

Filesize
61KB

MD5
f7e2865cbfaf7959efe89a61ac5f68d6

SHA1
fe2eb8ffdb68bbeb1f89aa1367e60ba8c96cae01

SHA256
b6d2fb11e3628d42fc3bf805cb17cae400adb40c2628fdff71380c9854292b97

SHA512
3078f31c93db32983964bd0ce5e28208146b403e4683ba915b647750f844996f7da1ef9aa683a797b96437dbbaaca91d0a13ce062ae97213a7ef083cd93793c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
41KB

MD5
e1710b11cbc2d52bc2a32c62bee61678

SHA1
3b419802dfd0d0c8e246866c04103fd2cce3ca02

SHA256
49a561182de033515199177a27d4b25aefb7ea11bba810b0dce1295c7143fedb

SHA512
9a019989654680e0b04af817abc3f1910a1f1866f87b1c87aedcccdff93ef3f54b3d52dcf564d9ff36dd5700a5108ddbfb7a6a2d9a3c45c7327b893a14e2e545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
32KB

MD5
bf3374aea277b1a2fd565411632b8be1

SHA1
566810056bebd5e7c49dd0152172420df0da80d8

SHA256
bc5cbcd9da009a0a01fccd07b48e82335ff362e2f189ea90e2ecdded5074297f

SHA512
eb8fd2503731a747e4a2ed6382fa6045b3fe8e51c910ea78fc5ab192b1aadd34b3e39d7efcb01e8897a6080453606a010f39a49d49ad773e3a030188ee2cfbc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076

Filesize
19KB

MD5
f72985e69526b4ac9d72a6c947c0b4c2

SHA1
fa178f0bdfe2226d273322f4485c498c1159f74e

SHA256
09f414b9588a7510d62ccb1bdc4f4ea61b0b53ec3e8810020ac93be843db3e01

SHA512
5e4bc023572e0111c011f52279d45d679056e31c50afcbe705b55ed289c03fcc73e22e1631da364664579e49428abd82b3f1776c3f06408bb490f895f083b75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
9847eda45cb620d99ae78a2df3c0ba71

SHA1
d6834918b420e03c1c2ed5d84bd96b778bdd4867

SHA256
56ac50b474d56078523fafac6ff573cf276e3e5e95ef4f6b329d6fa1231e4344

SHA512
87a18e3c0dbd7a861055fa5e85bfc52628d9f35e9861bef72f9bb2101a5e546629a60d83b184cf8df665a0a3fb5141ce703ef955920e6e1cab895ab3294cb810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
90d5ba217952f0dffffa9557841b27a9

SHA1
7bbbf5e3f77c4e1b8d9b851fa935f1762121a918

SHA256
5e6827965bc4d00c5cf6a30c03d77c0d8d9879a6fd4440711ea5ed61b22b89ee

SHA512
48439ac29c49b905ca5c02246cb0ce97688f882679bf53e95993d6a34d8606c5d081c4ca2a02bedcdcf2022aab9edeb7d438cf00db73eb33b4030b7f09ce4d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2e0f62212000227b94aee486f5bd903d

SHA1
6d823647cddf3042a4a3c2647c13f30ec8e8fd66

SHA256
26e1238e6bf2230d981509321af0cee54e93c84cd4a964eaf953b18bf6394d2d

SHA512
9b14a5ecd04549c6825387a066bf2bcd996910526b9eb27b83e318fd20f0d043a0820bd01a3c972df5e29bb3ce5deb4b68634949e5c57cb2d91c9c808867b243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b0adb7df8f05e804b12c9f3d8bff543f

SHA1
f6ab29a80bc16031bf1dd467deb541e65befacfb

SHA256
f5bacc2aa21b338335b9d85c3454b5033fd353bca963c9ec41b4e47b15cadf9f

SHA512
77efb389387a2a89668c837915692a3ffbdad291b96014aad4f40b13d8ce2674b0b0a28c2a1708861b0faa375930025c7ddb6a30143476e93829ce1d059ada88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1ca9c07abb257ce0f14e570e9e49298a

SHA1
d1524e0e295170434dc9f4e1ba0ada07a7321b82

SHA256
c744b859b73b33c78bfaf4d5ee3d4819f2ff4399c26b0f02d1d756403fb8b8c0

SHA512
f7d10fae23fe007e10ae417546e0e36d0a8ee9e5eeb60bd713a6d7f21f84df0964fd4e32cfd332672d6bb09328f3bc4550a7309a1d9d7e2f07651d277d012d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b85ab17f846bed6d4c1a0caa65a7c8c1

SHA1
e391252ad352364948ae31152615dfbf6de301dc

SHA256
a33b49b5117c1fc4f4fda6c75596eedab2f5844bfe8cde28fea106a9a09c76ff

SHA512
49577f9609d3061932ebdf046323188e560534affb1f630bec958a78d6cb9ea46a9595d2e15cb2c04905a7ed81e1d0c3c51301540dcc9357a7cba0128241d544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a808e186c9c9358afefbbd437d9f86db

SHA1
44a65dc0c33ad34e7753fc8b644f018b81e1d61a

SHA256
8519f5c982684538ba6d5e787c6f9e32e40b74de6f3c4f0205962239f1157847

SHA512
a3cab15d88b380053e77f4bc55f87862cdb99902a0d0954997fddfa49263bc9b553a127970f8eebe1db7024ec6288ca0b56e4a9fc35279a162958d400b496341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3a21719b00969cb6c2d3f7490c512564

SHA1
c4a2fb43d20a600adbaba1e10b8f641842c5b18a

SHA256
e6e2fe25c6cd55173e1b11e12606f1dcee2978aa671bf6401db6af245c5e3de1

SHA512
f7c97b0d2543fcfd3a0981f2f2ea92b5bc53e3c4939a4a52ce466cdfb595c52cf95bef95a67d0c2f8dd4ba2dfba773f9bd70ef7c18c37e0c276ed7ef94e0494d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6625cac0bb74908c0e2f15b37127d3fa

SHA1
875c570c99b34e6aa0cfd67305edfbfb0b793e37

SHA256
4ce417782510b057d52a39d2ac269a964214e92689a5b4284a83bd667ae4f397

SHA512
cb17964e14ab1738a8819eaa519506c5a4e9a816dfd5cba6026fcfa59dc78636552d39207a3b32039d5b0b7e68c44514d1ed23edc119959a4e9f0d2b946ce6e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
893c7240cacc45b78e888e36b835443b

SHA1
8336408377ef78b63ddd50a9d0c4987e036216d2

SHA256
c5d8ae452670e2ee7cdf8d17e60f7d11ea312e2b9df94046152c5203864a90b5

SHA512
2dfd9d6f1458994a278b0fdda8431f4500d853fd667503e186293e73a475e38cf2ac599fe4c50058a198b83036f481accb388af04a537930b0d7085ea1c64a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
79522f2f125be593dd9133ab07d122d7

SHA1
23402b80c6731f4a8614c23a54c4e0b301b42778

SHA256
81b473ddfd6440a160389fc55fdab464c1b551529e8790b68cbafd869798b562

SHA512
506645f1c31940ad65d9d93848489d5f46091c319da437fdec3fa04dbee11f2791011de2648dabee9d885105e08c2a2bfbfac1438739cb535e79a845e6b92191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98efbc4139783926a646158517805a2d

SHA1
9804ebdbb569793bfc0a4806a73207b04a4be261

SHA256
28716c469da6168e3ebf860a95522bda453f17e571aad49aa7a28a708fd03845

SHA512
8b0c965a70c9c3fc97c9f9a437eaa93f8f4b72bb16bfb253ea5444323e37b0d28c6e62d43a56d972458b31376fdeb20429c48ee4c270a7c712b953bc2af0c7bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f04f7bfdf586fad7e01d18031bbdbe2

SHA1
7d9bf7f25fa8ae185e57faa0a042963c142455f4

SHA256
b886f9742e5fa3f7e3de526944b45e50d8c672d926bb8797738db874fa3aec97

SHA512
f25d500e4c97d45662d0be55b27e6a8be607bb942e49c5ee51ec35cf51387dbb5c2a6ebc5ae6d035822396dbfd52fffc220c52f72640c959f943117bccd580df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d98bdbe61a4925e59e17ae194537526f

SHA1
7aec92c3bb7e929416854a2b50adccb30890c0a3

SHA256
c49d1206d04e883bce004fd43577c3a51a32a52fa78c459d0e61a3a650cfa3b9

SHA512
b2afd54e183c15208438d88c92a4b8b92c5f6f4404a20fbe882bd9e8e57c12a482603e2be55cd3499af39bdd5e89277bed3c861f7d7772a7a08f7eb8670facfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f1a71c7c858eb3ea4b380cab29ccdc34

SHA1
ef3b3570edbcaadfbb32f30fb267b61ecc18dd03

SHA256
d40b6be733d818bbd298b3ac130c27a3ac98e3c058c476d1d1d0fa8f4ba1227c

SHA512
8d864020d98b1c27a86f3a300180bbc3bfc7921975b68490c39832b5882768e8a5d7899129f0b2392a50b367f614d5c7563cc4f1954f0345968e5f5515913480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
366e8a92301305d1cb853a572bfafecb

SHA1
00bbde9c023bd55d668d0c546c7f62825109981b

SHA256
3d017faded51017b17e44f32953af55cf9b3325ccc907eb8677747418c77d7dd

SHA512
23038fe2990c7237767ead6b6aabce8cef4d1d0de9deeb47b7a94c012aded6f8c7bf1327b68801a4aa8cb3ec05cc594287ee04875073953de165505f244f1caf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff2cbc4dc09e45c50b9c19191cc0f7bf

SHA1
6386cf58e6bb37ed6025fcaadb655d3fd4debd77

SHA256
af5d532308f3291e16a80bcf9afd62a6f3964cfb1c6cda2902a0fe326188585d

SHA512
06b9b05fdf306331b275a9361f7efe9def4d3062f1f2de2989d83f18f6f78fc8d845376a380610ef42712ec9efe58380005773b075eb8f8da5ae000cbf020c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8a42e87ff14ac149105408ad8ab87fb5

SHA1
7d22a76b7a4a50d10ee479cdf4860329903077e9

SHA256
a310379f3b659ce661d1a794b536dc812d43392c42f57b935cfb39119513f7d3

SHA512
ac847c5900105296077565591fbec2e9f3b4d22570bfc4c77197cfa0473ff4e6e7eff35ee918381b9d9b093a2392ee9aaa58b3c580f540055ce2e02687046025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
032491e85047595dc062493e2541e314

SHA1
76b98645d98235a8e55ea423fa32dbddc73ac233

SHA256
11c2287892e1d94e5dd1843a51426d0d6459c8ad4a6770f73f596687e495bc26

SHA512
a50a0ff151ebf6b9d8f688186a53bf95e91d755328f8169626b1e27a53585518465dd0435bf6e94224a42613008b941c1b1d875c8aba3abf813a39c2fc424b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff718c6a81bdf1bfe945152669611048

SHA1
6d6af63ada5fe717e6e362760445e60354780604

SHA256
0952c6c4b1d5a545e9abb0f94cc49b933ad03b4af45705e186ed39d950cb4a0f

SHA512
c85c109fc50c4855cf7ccce43d873f198d63a7ce4671597516ddbbf64d3b64652a5f318a4de9aacfe8140c538ef269ea2844c616174985352f60df765a97ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d91b66f6fae74cb057668c612bab07d0

SHA1
fd51c2bf483db19a63dc3b79f1a5a5c628628346

SHA256
054a0547c4b1576c1937893fc7462af309eae3a0641f237f7f5bcfe10793efc8

SHA512
4cf381286a641b307143154a8473bcbd5c46afbdde15fb22253c140604ad1959785dab9fd2349607aaa074e68e807b7aaa09cc1e33d944287693107996df9756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5bbfc2.TMP

Filesize
538B

MD5
5e9e6b410d58bc6e574df61c1755171e

SHA1
33776e40a5e8196dd276617ec8044c1524dfa7d5

SHA256
0c1a2e34433897703be02aa5d3bd91eccb8022a990243dc89cc4c0a5df7b7f4b

SHA512
a18337075570cdaa440f097a82bf231c0b27faa5427a153585077b85c9f1d15153d51c4a224c3fdf0c26b9451fbb973549787567294ba6a7556474e9b0c7098d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e9c38d845c19c54307ab119336eef835

SHA1
fcad9c355f0e6d5237d0fff0c142e825eb78e835

SHA256
38ff5f2122d261821bdceecc67b14f3146499ac907331a8802bd23f7cb017e87

SHA512
58711349ccc4a7b586386f874de95b6addee16496c86857124ac8a5099effcfb14efa64df9554c64a503aad45842b3babb6599104852ac35b724e252cfbcd7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
858f6a27a12cd6e3400ae4d3a985b65a

SHA1
1b9fa8f19abb600e1df68dc5a75e3550fb6dd207

SHA256
9097c28f17e2b3d737f5dab6d343399f44c0edbee96e8d78b296941353e6d58b

SHA512
9c6e70b87ae1bffa7e05206b868fbae36b797cf4ed72b9cda7e3e71963d4531831eefb00049cfc9f57ab7da439ce0598a8fb98ab09a50ccf447352234ccb0dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35bacdc4a857c5cf82f0d4ebbc268a1d

SHA1
8a5a3d44bc02b2bbb3ff7ca88e6bb9308e824e3b

SHA256
f0b2b502fdf8bcb3caa661f817c95085f01e7cd2cc07c44e8e656629db8b9524

SHA512
2c3d9e9c040a5ddce6b07f06c68ecd43294ec928a66f3cf7e61402e37645e4909b9b7615790a62efe882ab20ca07f16d86b76889720eee54438d20af8e45ffff

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAC35.tmp

Filesize
421KB

MD5
6425466b9a37d03dafcba34f9d01685a

SHA1
2489ed444bce85f1cbcedcdd43e877e7217ae119

SHA256
56f8ca5b2079bc97a7af9c015ed4b6163635baef0d9a287d19fc227fc330c53d

SHA512
62f4c79d165282db14b662d4242a065af4c8a642f2023032ab5a059e2d6001f0b80e9a0562989013acf01a80a67491be9b671e6bd99220cf9d4fb44a17719371

Download Submit
C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BException.dll

Filesize
142KB

MD5
a2d4928c9836812735b3516c6950a9ec

SHA1
01873285eec57b208fa2d4b71d06f176486538c8

SHA256
79ca108d5c51259d8fb38ed1cfcc5a70e9cf67a5954e52a4339b39ff04fa20c8

SHA512
d03964a2bb597bf0fdefb787de3b462010c4cd02d286b16587a03b5228553a307d1b8f472c312e0d8bb53f21570aa5b112d85193cf42b83ef33fb7905855eba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{09EAD19A-804B-444F-B17C-15F8C5837E63}\BabyServices.dll

Filesize
922KB

MD5
11bf30b923d096bc73918c6079a927d3

SHA1
c75809bb25651e4e94a0dcdb2d124e64dd49287f

SHA256
60e601066d4a203e39eefe70ac05e1aac9b45f47f532e038affa8dae4e009275

SHA512
3f22b336df3a311ae707132a0451c83642683a01e1d0dd1b01f7c4f182efcd0bdec4c3effe02321d0aa619226f80853356e7e8692c443bf2f74a9ea382b3f03c

Download Submit
C:\Users\Admin\Downloads\GTA 6 LEAKED!!11111.jar

Filesize
1.5MB

MD5
0d30e7a4135a27a6613794e34fa727e9

SHA1
a29d638a48ede2a08a97e4aa0b8d25bf86a763e2

SHA256
62e1529eb7b8d6bc250416a720c2d8a742a600f694db790d60de3ddbbce37499

SHA512
48c235e8a2d8ffdae3eb060d0ebb27f7d2e3733466b8b082699e2ed173552a2d8373921e36daa991b1e133374339e361bf4e8f92a615905348b1a5af53cc4d53

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 487497.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
\??\pipe\LOCAL\crashpad_412_XEGPEWLCASPQFPXT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1008-1358-0x0000023493090000-0x0000023493091000-memory.dmp

Filesize
4KB

Download
memory/1640-709-0x0000000002820000-0x0000000002847000-memory.dmp

Filesize
156KB

Download
memory/1784-802-0x0000021745CD0000-0x00000217465E4000-memory.dmp

Filesize
9.1MB

Download
memory/2764-1336-0x0000020902780000-0x0000020902781000-memory.dmp

Filesize
4KB

Download
memory/3604-1369-0x0000020E16080000-0x0000020E16081000-memory.dmp

Filesize
4KB

Download
memory/3936-769-0x0000024BE8BB0000-0x0000024BE8BCE000-memory.dmp

Filesize
120KB

Download
memory/4748-1347-0x000001EC12E50000-0x000001EC12E51000-memory.dmp

Filesize
4KB

Download