asyncrat | 8f6baf69e7e047012b20299cd4d3bf4f86eaee8c7f42fed6cb4a33b79ef51dd2

Resubmissions

11-11-2024 13:51

241111-q54elszdrl 10

11-11-2024 13:41

241111-qy5zvstjer 10

11-11-2024 13:36

241111-qwhrjszdkn 10

11-11-2024 13:30

241111-qr3k6azcqp 10

Analysis

max time kernel
194s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SunlightBootstrapper.exe
Size

1.8MB
MD5

7c4f1852448b6217ca92deecaceb6247
SHA1

23f8b47a3a5bbcadb7d01dd8a727e0c2c48c0848
SHA256

8f6baf69e7e047012b20299cd4d3bf4f86eaee8c7f42fed6cb4a33b79ef51dd2
SHA512

4ef4281529f2159761f11ad890da0f7d79e2513019a1fd717b312ef2fb0ef9d01a54cb07561e40b0c12edd46089a8228f977ebb2ac109939bdddda57fad2f812
SSDEEP

24576:dsmUYlIZ2RBbEeUhk7Dz6rdnkYA1LUqBFJJCZm4E6+eQ:emUYlIckeUAGnmLtFaZ0pe

Score

10^/10

asyncrat default discovery evasion rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

109.87.212.225:1337

Mutex

oIyMus9FxRxA

Attributes

delay
3
install
true
install_file
dwm.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Modifies security service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

disable-defender.exedisable-defender.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3"	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3"	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	disable-defender.exe

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023c94-6.dat	family_asyncrat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SunlightBootstrapper.exetmpA42F.tmp.comdwm.exeSunlightBootstrapper.exetmpB94.tmp.comdwm.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SunlightBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	tmpA42F.tmp.com
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	SunlightBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	tmpB94.tmp.com
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 9 IoCs

Processes:

tmpA42F.tmp.comdwm.exeSunlightBootstrapper.exetmpB94.tmp.comdwm.exedisable-defender.exedisable-defender.exedisable-defender.exedisable-defender.exe

pid	Process
1532	tmpA42F.tmp.com
2184	dwm.exe
4456	SunlightBootstrapper.exe
4596	tmpB94.tmp.com
5724	dwm.exe
5996	disable-defender.exe
3652	disable-defender.exe
5904	disable-defender.exe
5952	disable-defender.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

disable-defender.exedisable-defender.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	disable-defender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	disable-defender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	disable-defender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	disable-defender.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1"	disable-defender.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	disable-defender.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeschtasks.execmd.exetmpB94.tmp.comcmd.exedwm.execmd.exetimeout.exedwm.execmd.exetimeout.exeschtasks.execmd.exetmpA42F.tmp.comtimeout.exeschtasks.exetimeout.execmd.exeschtasks.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB94.tmp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA42F.tmp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 4 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid	Process
1988	timeout.exe
6052	timeout.exe
5332	timeout.exe
5472	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 3 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 462729.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 654140.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 469463.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
672	schtasks.exe
5352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exetmpA42F.tmp.comidentity_helper.exemsedge.exemsedge.exetmpB94.tmp.comdisable-defender.exedisable-defender.exedisable-defender.exe

pid	Process
2876	msedge.exe
2876	msedge.exe
1088	msedge.exe
1088	msedge.exe
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
1532	tmpA42F.tmp.com
3596	identity_helper.exe
3596	identity_helper.exe
5844	msedge.exe
5844	msedge.exe
6100	msedge.exe
6100	msedge.exe
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
4596	tmpB94.tmp.com
5996	disable-defender.exe
5996	disable-defender.exe
3652	disable-defender.exe
3652	disable-defender.exe
5904	disable-defender.exe
5904	disable-defender.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

SunlightBootstrapper.exetmpA42F.tmp.comdwm.exeSunlightBootstrapper.exetmpB94.tmp.comdwm.exedisable-defender.exedisable-defender.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	1692	SunlightBootstrapper.exe
Token: SeDebugPrivilege	1532	tmpA42F.tmp.com
Token: SeDebugPrivilege	2184	dwm.exe
Token: SeDebugPrivilege	2184	dwm.exe
Token: SeDebugPrivilege	4456	SunlightBootstrapper.exe
Token: SeDebugPrivilege	4596	tmpB94.tmp.com
Token: SeDebugPrivilege	5724	dwm.exe
Token: SeDebugPrivilege	5724	dwm.exe
Token: SeDebugPrivilege	5996	disable-defender.exe
Token: SeImpersonatePrivilege	5996	disable-defender.exe
Token: SeDebugPrivilege	5904	disable-defender.exe
Token: SeImpersonatePrivilege	5904	disable-defender.exe
Token: SeManageVolumePrivilege	3752	svchost.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

msedge.exe

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

disable-defender.exe

pid	Process
5904	disable-defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SunlightBootstrapper.exemsedge.exe

description	pid	Process	procid_target
PID 1692 wrote to memory of 1532	1692	SunlightBootstrapper.exe	86
PID 1692 wrote to memory of 1532	1692	SunlightBootstrapper.exe	86
PID 1692 wrote to memory of 1532	1692	SunlightBootstrapper.exe	86
PID 1088 wrote to memory of 376	1088	msedge.exe	91
PID 1088 wrote to memory of 376	1088	msedge.exe	91
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2564	1088	msedge.exe	92
PID 1088 wrote to memory of 2876	1088	msedge.exe	93
PID 1088 wrote to memory of 2876	1088	msedge.exe	93
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94
PID 1088 wrote to memory of 988	1088	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\SunlightBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SunlightBootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\tmpA42F.tmp.com
  "C:\Users\Admin\AppData\Local\Temp\tmpA42F.tmp.com"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwm" /tr '"C:\Users\Admin\AppData\Local\Temp\dwm.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2488
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "dwm" /tr '"C:\Users\Admin\AppData\Local\Temp\dwm.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB73A.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\dwm.exe
      "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2184
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "dwm"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /f /tn "dwm"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFC32.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:6052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d7da46f8,0x7ff9d7da4708,0x7ff9d7da4718
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100
- C:\Users\Admin\Downloads\SunlightBootstrapper.exe
  "C:\Users\Admin\Downloads\SunlightBootstrapper.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\tmpB94.tmp.com
    "C:\Users\Admin\AppData\Local\Temp\tmpB94.tmp.com"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwm" /tr '"C:\Users\Admin\AppData\Local\Temp\dwm.exe"' & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "dwm" /tr '"C:\Users\Admin\AppData\Local\Temp\dwm.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C5D.tmp.bat""
      4⤵
      System Location Discovery: System Language Discovery
      PID:5616
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\dwm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dwm.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5724
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "dwm"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /f /tn "dwm"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4DD3.tmp.bat""
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2168,15444299037008248038,8069433355742472539,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5896
- C:\Users\Admin\Downloads\disable-defender.exe
  "C:\Users\Admin\Downloads\disable-defender.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- - C:\Users\Admin\Downloads\disable-defender.exe
    C:\Users\Admin\Downloads\disable-defender.exe
    3⤵
    - Modifies security service
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    PID:3652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

C:\Users\Admin\Downloads\disable-defender.exe
"C:\Users\Admin\Downloads\disable-defender.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5904
- C:\Users\Admin\Downloads\disable-defender.exe
  C:\Users\Admin\Downloads\disable-defender.exe
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - Windows security modification
  PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf5f284ebh9538h4ea6hbe87h355ba1bd60c6
1⤵
PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d7da46f8,0x7ff9d7da4708,0x7ff9d7da4718
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14268829072140024081,14601648256791760232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14268829072140024081,14601648256791760232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 /prefetch:3
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14268829072140024081,14601648256791760232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault48722296hba75h470bhb9d3hcc436d0b0048
1⤵
PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d7da46f8,0x7ff9d7da4708,0x7ff9d7da4718
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,10980958582633194775,2205219461978011419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,10980958582633194775,2205219461978011419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,10980958582633194775,2205219461978011419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc05b902bh98bch4756ha770h8367afb73d51
1⤵
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d7da46f8,0x7ff9d7da4708,0x7ff9d7da4718
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8716839648773621601,612001731720639906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8716839648773621601,612001731720639906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8716839648773621601,612001731720639906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:5172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5b870b3ah2ac6h422ahbe0fh48935b2c529f
1⤵
PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d7da46f8,0x7ff9d7da4708,0x7ff9d7da4718
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9866371824075571345,1566925781932137776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9866371824075571345,1566925781932137776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9866371824075571345,1566925781932137776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
9b6cb79a92108c7391e285ee66a0088f

SHA1
dd1b40c9728b5ac58d7e75806063c2744c41966e

SHA256
069d6110028f761788f73662a457788fb64f2ce74c6c4f496803aca331ac9c52

SHA512
e35bca82b1cecc10df1c07a3ade9afffe385812b4f96cf67a0d914ed9edc31ef374be89bfe7e5f260e0932caffec56cd8a3f78ef917ede3513ca5159990d7bb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SunlightBootstrapper.exe.log

Filesize
847B

MD5
66a0a4aa01208ed3d53a5e131a8d030a

SHA1
ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

SHA256
f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

SHA512
626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
3470d86fb63477112cc0d3685bba9702

SHA1
28c9860841dfa3e25e0a73b5db6ac559c673fd10

SHA256
bdb18952bc6d422dba8be2dfb10629a3c74e671e0179d2f398aa02e170c6704c

SHA512
d321d8d516d5f7099e8a2ffa944a822af3cf7021266f65dc3abc4393fd8d153ca667d339368479e4bb2b0fb634b8b7d3d2ec41e7bc564becd53e8959790eb0d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1041b17fe76b2683ed91e32230a8a8a3

SHA1
3846a20b43edbced681ffa6d64883bce38615682

SHA256
73e546d36485636ad0791fb4eba0871499e09348de3d8d0d3bd8c0ea8140a705

SHA512
0c6437afdb1244f69976f7030c8d293cbe0b4c7a9baa2b3da1255019e1e29996534dac0b1a8f6819e6e979b9e365e387081495b96ad0eff794bd24970d00d211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
115277819d277d50eedbb6885c3ea329

SHA1
5289a784ed1407718b337425a7ee8f2244ada377

SHA256
fb435a00b429037d6b293b2c197e45fb9d679cf583e484015eb66e14f268bdf1

SHA512
9e4c4568182b5b5d3cb2c444c0dc2dbc735c84830912aa759fcb2f908afef1bacb62ac0765d54fdadb1783e04c1546f2aa35a5254a1189af2e102136ec761e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
07627319370273ee0e517feb49ef314d

SHA1
32591a386bcdeaa3a6b57350bed77d6727e85bf5

SHA256
8f2f7279b27a86c92a81ad5ea46c758867430408b48a75802176bbdeb6c62550

SHA512
381838e79a5f44170db180471896d7ee2e4295bb2ebbaedea49f23add1367557564dfb1ec74923d9a2c3ee0e7fe41bbe215336af5a9429e0dee4e0fcc4912a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7d8cefee587270c4c9fabb49548e034e

SHA1
69c668d0efef5785d69661f7b9bdbf80b05d97ad

SHA256
695ab9bd62788e4d117b0a2ffe9902638c1866ba59b5a52fd9401ba6d6c4113c

SHA512
407b402a09dce197d035ba73e4c39f687b07c1cafef89305c080ce1aa20b49c0e8de8732db31a3c3ba46380fd4e1ba33f9528e510bdceffb297d1acea76019ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c1d0657-a978-418e-88ff-fa87723e7edb.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
7a3865c9ef4b992c348a5d87ef16b62a

SHA1
174112359d9eb1e5dcf4af450bb018bee45ff337

SHA256
895b800d4f38cd707908cf725545b20acfc422a6ac176329f1824f33e243d411

SHA512
483fc4ea49e8a6727df621af5fda3005279aa57d767c85e1356c62fab2eb6437d7c9e2acd048a22be0697fdbe1acbd91ca7244decbd16e415f729a0187b2f473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
09e2cd180ec7dbca5bb3491ed6835d8d

SHA1
880a1eabd809a8422b2f9b5704a498162bdbee5f

SHA256
365fef0c5d346b91e7663af89c45e6a7b503624d2c3c3c0c91e6ac8d5ae0256c

SHA512
b499e47b9113873bd143295439ddd412bf7c4964c345d7b12665a6d82ff0fd6602bc39a6747f8209de626aecb6bd40eedbf5713ffa1f945bbd8ce0acbab0c379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d08d64a1417e98998683c46dcf00706c

SHA1
b13a0ccad0339ee8ae435ba42679149c2d08c13d

SHA256
ac3464a151bdbbb77c3afc5a5630d758b0c4c2764e9d22cab4251af098ccea52

SHA512
08e03a93186a63da0748e0b6f1ce4ce2867649f4b22e7c0bfc96955395cd142e4a6e6082f73580728cf06b52b2c7d8470350742b00f005b5b0b30f0971077698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13f27eddb5bd29bf14fd0b3728c21d0b

SHA1
d4e1ff91c6237d1466f403313b629bcd6692e827

SHA256
26ae24892463e66c9e9b6710357aa04c125921d85cb92404c9e1f6320561262a

SHA512
913fc384fb619079dfae81cbb3d5bd390365811350c81695477d607cd5868c54befb892754239b4541c9670c765fe46ae47b456c8f59605239201caa5f1582d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
741b11209f9d5d87ce1120766aa6c76f

SHA1
9c63238dcd45d1d080d4ab316d96cb192088a93b

SHA256
1b766a284707ec50554784006b7cc5efb286da5a6c9153d3707349a0c98af630

SHA512
14d715fd22477bbe3b99e76b14ede3e2b38b9f07955d9de228b11c36998a0de19757326dd64e268c1cce01d450106f80f015a19f2eb36c809d414229aff87abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20deeb671149d1d03313660f5dbf37e5

SHA1
0085b7cbb4804fe27bf975d46e77d086e2295d63

SHA256
e0bfc2690e257d1bbc469e05e2d424d822279960ceb43cbf626fd94c126a93e9

SHA512
8f104111fa17f9e4df8e0e92689af25f646b89bda1b8c9dc40036db187f58a4da394bed45faef40044a2ca40f83be5451b47605119433628faca5d4898347839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b309042c049bfb9ded09b06afa9286d

SHA1
42c3a183f759bed717213c525f0bd13b340ee4c5

SHA256
bf47ba43943b4952cc5193f8ffcc85e68476123203ba49d7845429a6aa4d0167

SHA512
2088b57e7bf2649f00a9865e265b579a5a6f9c5dff0fddd4786f30adda27a3ec7456c26193ce63753a2bb2090e65e2b81d39b62ad0222a0264798f6d0ddef454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
fc45121a222c18219409d7b247bbadbe

SHA1
b3bfdab5276bec92fee18e6e0e01d6d2a5c9e423

SHA256
116cff62f750f09f04d409cc085a524e48f607389d5e94a3e9280247b6bae77d

SHA512
c605193b24b77ede4fd736ed6c529c19ad06e37cd045e75bafa92ef97385a906d96b802e40400c102aa2114532d4607b3e2e4502591c66cb9995252770fb915e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
13619164b55c99175b8a631aa85114cf

SHA1
cb168bdda4c1b603c93b9242649f6825a0282142

SHA256
741b54f19625d1f694b5c8f0bab6c825fc867de5588c575a13e0bb564091f757

SHA512
63d16f368983896e31809a75b77078d629471c9a9b727ca676069137108521535ed9371f1cca266f5966457f9957bf2001538ef9b43070f9a38b4cefb6c759d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
3307dfc283c978f6afda47ff18f29c7b

SHA1
39244db53f0317321336ecffac7350db946b8da1

SHA256
63caa2e9a57766ef4f3a2713c227a3027f18502b8d42a35a52f891a453aa7bdc

SHA512
a522869c3913fb144df875a6379f1b203f63748794fecef05c1ffcd3cdd6ef1952a450f00567d050434951b3e3c83826d95dc678517292d74dd0f0ce36dd7904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
305586aa76e325b50812c7b1edcd244e

SHA1
1e57ce2a727628dd2f971b35a10f92ffbd3bb67c

SHA256
6dbf022c27704e1bd1564cc992e1f3382ac7a13064ccbbe7679b3e4362cf4d54

SHA512
81ca2a2b354ee7cc4006d77ce59d64ba04548dd6ac676b0838ac22ab0bb127d5d371e8aa3db6e285fe831570e3c981f97d2e8cfa63ff1d74b81e7a391667623e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
e55f7a6c7123f5e77bf2d99332d44773

SHA1
7b03ed8896e7d38862e8c4d8a57ec93f236caaa0

SHA256
3f6bfdeb5814d1439628b7e8b980f538d02281553b5e54440fa23143c4699238

SHA512
80b4d1d46b8bcb100575f40b08aa017201a273f2064d561c45130bf63201f9922c0e840eafeb53024d4e53d722b1635e8394be5b5b7a6e5683d358e19c1e86f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf0f6977c1f131687145f49197e82197

SHA1
ca3948fcaf4061256a8d5d8de6056c9ab807b574

SHA256
6499e61fd4151161c9da782cc9f4f3ff9db465330a9f89be7dde7948471beffb

SHA512
d13b0d949b450110a4ab69e4f1436c3c8aa5dac2a76391eb06338c1a7acfb2bc93243a9f62c0a5f4f5bcf982b3a9d02698331a6bd52c868ddfeaf6a4ebe93e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
761ac7660f6f1f426132f15c94a958d4

SHA1
fb05730ee85848a0a4664984926fe845335455c2

SHA256
7e805bebe4221ad8f0748b52c3e8d5349ec315c9ca202f2404feef82cd6b9661

SHA512
8215cbbd8249c1ef8a40615bb1d7e5743ed1665e92d560dc8e3a890f1ff2c77fc8648a81e0566e04598eccb31c13f42a82f99a7ea2d2e7aec56ce0bb96672115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd63ad4fc3925caab7d3f9daf4edc6cf

SHA1
b39da0d20b6b70e97ee4ad4cae4d88937de85e95

SHA256
4e28f7842ebc2b953513f0b1e6af45cb38f73db4ec5d5eecd4f9ab403286e3b9

SHA512
dd9554d03ff930817851081491516f3b20de5d5b54b50686774355dfad87f012fd3670982e4ef3691d0ad4ebfd530603035dff6349f145706cf6397332785d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4aefd7bf1d53b1014e7ca1398e4c3777

SHA1
0209f19b6bc65114cd98d9c3bd9433ca2c0403e9

SHA256
62ce844e2e48d41ced7ffa77db38e7f9df9b1c23b92ef38a6ec440fad8990c1b

SHA512
4a1a82958258c994f919996301b8b772bae581758377212d75c028a233330854159dd3de951d8e8385d90a2cde2a05730f7c37fc384f9cbc9b32c554ea43bbe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
728e7e62ae5b4244063fb18309152dc1

SHA1
5ee468d524acd2d71ec914d255ba650c7bdbc4fd

SHA256
aae2bcff8d2ec74edb27c3331d0788cd5bfb0ee243c46b58bbd251b6d7173dff

SHA512
9d87adc66cb0e3f7af0d75b687686fc0ca8bd2eb73fc1301e9a5023ff95248040ccdc4c9375fec49228397264309637b90afcd994e6f1d84eedefc29ed84a0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
3e5a56760e338f9953df973c660a548a

SHA1
a1156b2b09265c004e1e1a1bf36b0874921e65dd

SHA256
760e1af1033ce39f650375ff121cd45c729172ce0e7d16c50b9d9abdc64c379b

SHA512
93d14920e86ced728d7f95b196c874225e0101ba395ebcbc068b6b784b593e35a9c19820c4af0eff9236478701011c4dd639aaff918bc0ffea1dc3419aaf4dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt

Filesize
3B

MD5
b56d54f78cc4e48a699f6ecf95e11a15

SHA1
c54a38679e0541ef6d04ad5047aff0985c136553

SHA256
1cf50cbd5d1ad55de3284ae82820cdb5c58a0a55504be95c6584c5f34662ee01

SHA512
fd61c2a6584e87293ff48a2bcd5a077d15d38778e31db6a070838a97d20f54fd6775d0db1855e28fc52626a517358f79d245a7a54435ccc3790dde8b99e02045

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C5D.tmp.bat

Filesize
150B

MD5
5ed2e6cece1558a2843f8f01a96cb83f

SHA1
eb0227e0d7fbae1b08848f8252d4d31f34c5cb7b

SHA256
5e5122b5c104d5992fcdb57b26387f54517535853f99f512c6111b698786ee67

SHA512
dfe6c28fd24e696b37acad570b3ae23e1eea641c2fc2d17694ac8a5a2738aebfc372a48f96b40584d0ab828d11a8e26cd1d33954cdd554d05ee682bcae391265

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA42F.tmp.com

Filesize
47KB

MD5
c19fe978050f62a6efa3e92e37099ac5

SHA1
17029ede51032d5809a9f8c9b501de24603d5bef

SHA256
8ff24a5f07daa0a3d30c5482229825037b2ed80580c2a9fc7734ba3b162dee4a

SHA512
9f23ca7704e608e68194e41ef948d01d60aeb8361de24f3984410db7400039b0f13d5f7fc54c639ef646715faafb72ea471f3cb6fe76eaa3682346dd09ad6670

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB73A.tmp.bat

Filesize
150B

MD5
166c69b8c295db85ce243c9b6f16b35a

SHA1
6fbbbc578c992593b0de84ba34f1de315fd9be11

SHA256
9be861ab92de1549b75f69b8fdff820eb3139f88006e13a968e44254d143177c

SHA512
19f01ec5a7385eaa5b0594a1bfc296e6b9e93c35ba4597d352d719480dd3e475d121378cae43cbd1405256023f1e5c30ec7b2f1aa3d368e483d82dcc19bdaf93

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFC32.tmp.bat

Filesize
155B

MD5
6a7a56fe1996ed9cfdf8f11306e0d22e

SHA1
f9877d26852592c3f43f2afe00e5040285b79afc

SHA256
50aa3f4440e1abe4c240fa4125afd2856fad226fefea0428ad86ce513afb2e49

SHA512
e8a6fa31737240c7284bced6377f2438e5c238c4e128461bf24775e0976f6362af88030cc5c5799179781f31b0a402d3987c1eda476db753c4988fe157eb9070

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 469463.crdownload

Filesize
1.8MB

MD5
7c4f1852448b6217ca92deecaceb6247

SHA1
23f8b47a3a5bbcadb7d01dd8a727e0c2c48c0848

SHA256
8f6baf69e7e047012b20299cd4d3bf4f86eaee8c7f42fed6cb4a33b79ef51dd2

SHA512
4ef4281529f2159761f11ad890da0f7d79e2513019a1fd717b312ef2fb0ef9d01a54cb07561e40b0c12edd46089a8228f977ebb2ac109939bdddda57fad2f812

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 654140.crdownload

Filesize
294KB

MD5
10fc8b2915c43aa16b6a2e2b4529adc5

SHA1
0c15286457963eb86d61d83642870a3473ef38fe

SHA256
feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

SHA512
421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

Download Submit
\??\pipe\LOCAL\crashpad_1088_YKUUZDKGDJVWJCTU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1532-8-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Filesize
4KB

Download
memory/1532-42-0x00000000055D0000-0x000000000566C000-memory.dmp

Filesize
624KB

Download
memory/1532-41-0x0000000005120000-0x0000000005186000-memory.dmp

Filesize
408KB

Download
memory/1532-9-0x0000000000790000-0x00000000007A2000-memory.dmp

Filesize
72KB

Download
memory/1692-60-0x00007FF9DB8B0000-0x00007FF9DC371000-memory.dmp

Filesize
10.8MB

Download
memory/1692-150-0x00007FF9DB8B0000-0x00007FF9DC371000-memory.dmp

Filesize
10.8MB

Download
memory/1692-1-0x0000024791390000-0x0000024791560000-memory.dmp

Filesize
1.8MB

Download
memory/1692-2-0x00007FF9DB8B0000-0x00007FF9DC371000-memory.dmp

Filesize
10.8MB

Download
memory/1692-0-0x00007FF9DB8B3000-0x00007FF9DB8B5000-memory.dmp

Filesize
8KB

Download
memory/1692-59-0x00007FF9DB8B3000-0x00007FF9DB8B5000-memory.dmp

Filesize
8KB

Download
memory/2184-79-0x0000000006AC0000-0x0000000007064000-memory.dmp

Filesize
5.6MB

Download
memory/2184-120-0x00000000072F0000-0x0000000007366000-memory.dmp

Filesize
472KB

Download
memory/2184-121-0x0000000007270000-0x000000000727E000-memory.dmp

Filesize
56KB

Download
memory/2184-123-0x00000000072C0000-0x00000000072DE000-memory.dmp

Filesize
120KB

Download
memory/3752-441-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-464-0x0000013748ED0000-0x0000013748ED1000-memory.dmp

Filesize
4KB

Download
memory/3752-440-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-438-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-442-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-443-0x0000013748DA0000-0x0000013748DA1000-memory.dmp

Filesize
4KB

Download
memory/3752-444-0x0000013748D90000-0x0000013748D91000-memory.dmp

Filesize
4KB

Download
memory/3752-446-0x0000013748DA0000-0x0000013748DA1000-memory.dmp

Filesize
4KB

Download
memory/3752-449-0x0000013748D90000-0x0000013748D91000-memory.dmp

Filesize
4KB

Download
memory/3752-452-0x0000013748CD0000-0x0000013748CD1000-memory.dmp

Filesize
4KB

Download
memory/3752-437-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-439-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-466-0x0000013748EE0000-0x0000013748EE1000-memory.dmp

Filesize
4KB

Download
memory/3752-467-0x0000013748EE0000-0x0000013748EE1000-memory.dmp

Filesize
4KB

Download
memory/3752-468-0x0000013748FF0000-0x0000013748FF1000-memory.dmp

Filesize
4KB

Download
memory/3752-436-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-435-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-434-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-433-0x0000013749180000-0x0000013749181000-memory.dmp

Filesize
4KB

Download
memory/3752-432-0x0000013749150000-0x0000013749151000-memory.dmp

Filesize
4KB

Download
memory/3752-400-0x0000013740A60000-0x0000013740A70000-memory.dmp

Filesize
64KB

Download
memory/3752-416-0x0000013740B60000-0x0000013740B70000-memory.dmp

Filesize
64KB

Download