asyncrat | hxxps://github[.]com/NYAN-x-CAT/AsyncRAT-C-Sharp

Analysis

max time kernel
492s
max time network
483s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08/12/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp

Score

10^/10

asyncrat default discovery evasion execution rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

boHsgySMwC8F

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AsyncClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AsyncClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AsyncClient.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0003000000000345-547.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	AsyncClient.exe

Executes dropped EXE 1 IoCs

pid	Process
3672	AsyncClient.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	AsyncClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	AsyncClient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5684	powershell.exe
2608	powershell.exe
4888	powershell.exe
4700	powershell.exe
1424	powershell.exe
4844	powershell.exe
2216	powershell.exe
5360	powershell.exe
4896	powershell.exe
5520	powershell.exe
5924	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
36	camo.githubusercontent.com
40	camo.githubusercontent.com
41	camo.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 3936	3672	AsyncClient.exe	141

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\58c3c5a8-3d09-4e07-bb3f-4cc4636a138e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241208102405.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "5"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 5a003100000000008859165310004173796e635241540000420009000400efbe88590c53885917532e000000cd3e04000000030000000000000000000000000000002eab2b004100730079006e006300520041005400000018000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000575926721100557365727300640009000400efbe874f7748885900532e000000fd0100000000010000000000000000003a00000000002e07080155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000b87ea63f5625db01b8873e595b49db01b8873e595b49db0114000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 500031000000000057596f77100041646d696e003c0009000400efbe57592672885900532e000000fc0804000000020000000000000000000000000000008b28fd00410064006d0069006e00000014000000	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\NodeSlot = "4"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = ffffffff	AsyncRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AsyncRAT.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
2964	msedge.exe
2964	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
1220	msedge.exe
1220	msedge.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
4248	powershell.exe
4248	powershell.exe
5684	powershell.exe
4844	powershell.exe
2608	powershell.exe
4888	powershell.exe
5360	powershell.exe
2216	powershell.exe
2216	powershell.exe
4896	powershell.exe
4896	powershell.exe
5684	powershell.exe
5684	powershell.exe
5520	powershell.exe
5520	powershell.exe
4844	powershell.exe
4844	powershell.exe
5924	powershell.exe
5924	powershell.exe
2608	powershell.exe
2608	powershell.exe
4700	powershell.exe
4700	powershell.exe
1424	powershell.exe
1424	powershell.exe
4896	powershell.exe
4888	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6120	AsyncRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	AsyncClient.exe
Token: SeDebugPrivilege	6120	AsyncRAT.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeIncreaseQuotaPrivilege	4248	powershell.exe
Token: SeSecurityPrivilege	4248	powershell.exe
Token: SeTakeOwnershipPrivilege	4248	powershell.exe
Token: SeLoadDriverPrivilege	4248	powershell.exe
Token: SeSystemProfilePrivilege	4248	powershell.exe
Token: SeSystemtimePrivilege	4248	powershell.exe
Token: SeProfSingleProcessPrivilege	4248	powershell.exe
Token: SeIncBasePriorityPrivilege	4248	powershell.exe
Token: SeCreatePagefilePrivilege	4248	powershell.exe
Token: SeBackupPrivilege	4248	powershell.exe
Token: SeRestorePrivilege	4248	powershell.exe
Token: SeShutdownPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeSystemEnvironmentPrivilege	4248	powershell.exe
Token: SeRemoteShutdownPrivilege	4248	powershell.exe
Token: SeUndockPrivilege	4248	powershell.exe
Token: SeManageVolumePrivilege	4248	powershell.exe
Token: 33	4248	powershell.exe
Token: 34	4248	powershell.exe
Token: 35	4248	powershell.exe
Token: 36	4248	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeIncreaseQuotaPrivilege	5684	powershell.exe
Token: SeSecurityPrivilege	5684	powershell.exe
Token: SeTakeOwnershipPrivilege	5684	powershell.exe
Token: SeLoadDriverPrivilege	5684	powershell.exe
Token: SeSystemProfilePrivilege	5684	powershell.exe
Token: SeSystemtimePrivilege	5684	powershell.exe
Token: SeProfSingleProcessPrivilege	5684	powershell.exe
Token: SeIncBasePriorityPrivilege	5684	powershell.exe
Token: SeCreatePagefilePrivilege	5684	powershell.exe
Token: SeBackupPrivilege	5684	powershell.exe
Token: SeRestorePrivilege	5684	powershell.exe
Token: SeShutdownPrivilege	5684	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeSystemEnvironmentPrivilege	5684	powershell.exe
Token: SeRemoteShutdownPrivilege	5684	powershell.exe
Token: SeUndockPrivilege	5684	powershell.exe
Token: SeManageVolumePrivilege	5684	powershell.exe
Token: 33	5684	powershell.exe
Token: 34	5684	powershell.exe
Token: 35	5684	powershell.exe
Token: 36	5684	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
3672	AsyncClient.exe
6120	AsyncRAT.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe
3672	AsyncClient.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6120	AsyncRAT.exe
6120	AsyncRAT.exe
6120	AsyncRAT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4624	2964	msedge.exe	80
PID 2964 wrote to memory of 4624	2964	msedge.exe	80
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4700	2964	msedge.exe	81
PID 2964 wrote to memory of 4380	2964	msedge.exe	82
PID 2964 wrote to memory of 4380	2964	msedge.exe	82
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83
PID 2964 wrote to memory of 3988	2964	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe3aec46f8,0x7ffe3aec4708,0x7ffe3aec4718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x140,0x254,0x7ff7f2b85460,0x7ff7f2b85470,0x7ff7f2b85480
    3⤵
    PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9452861216410302149,1641243330058489513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4796

C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe
"C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5392

C:\Users\Admin\Desktop\AsyncClient.exe
"C:\Users\Admin\Desktop\AsyncClient.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\121kinet\121kinet.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E12.tmp" "c:\Users\Admin\AppData\Local\Temp\121kinet\CSC40C50F256F4D4C6F8EEEB331C1ACC18E.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ehuyuzfp\ehuyuzfp.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB33.tmp" "c:\Users\Admin\AppData\Local\Temp\ehuyuzfp\CSC7604B16DC634B04ADD94DF7F440FDB7.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youareanidiot.cc/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x124,0x150,0x7ffe3aec46f8,0x7ffe3aec4708,0x7ffe3aec4718
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,5626249184595600646,12382030487273810433,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x458
1⤵
PID:5576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
f811272c20ff6decbbd16ff364334427

SHA1
cb31be66c972daa61d45920fa2fa824c1dfb194d

SHA256
730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592

SHA512
5c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5fffb9ed7c2c7454da60348607ac641

SHA1
8d1e01517d1f0532f0871025a38d78f4520b8ebc

SHA256
c8dddfb100f2783ecbb92cec7f878b30d6015c2844296142e710fb9e10cc7c73

SHA512
9182a7b31363398393df0e9db6c9e16a14209630cb256e16ccbe41a908b80aa362fc1a736bdfa94d3b74c3db636dc51b717fc31d33a9fa26c3889dec6c0076a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
32d05d01d96358f7d334df6dab8b12ed

SHA1
7b371e4797603b195a34721bb21f0e7f1e2929da

SHA256
287349738fb9020d95f6468fa4a98684685d0195ee5e63e717e4b09aa99b402e

SHA512
e7f73b1af7c7512899728708b890acd25d4c68e971f84d2d5bc24305f972778d8bced6a3c7e3d9f977cf2fc82e0d9e3746a6ccb0f9668a709ac8a4db290c551c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
295f18102d24c5deb473f2dc2a50d750

SHA1
394c96ddb0a8cdc2bbcfa08a36a5d4d0737b6563

SHA256
f87c6c50b4c42cc063df5e1044f6ea93dcd47ce2ae11cce1af9f6e3df7997dfd

SHA512
81628f7fdee04de81323b29cf38c587d4735c6323afdab63ce6be8c87ef026d7f0edde21f602e80289bf13fe41d1f0599fb0634973fdccca345439ed321f7915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b4b7bbbb89cedb6579e311868843111

SHA1
77a46b5a0c654490f2ec294b8a3a9263442bba6a

SHA256
5bf092527e36bb4f3d3817c9e26a04cdea3509ce45adc4094864982c6b15da28

SHA512
9e838d3bb3b1a2a1a0c89729b01ef737c1e33f3b36ef849075e489d3e90149e5d6fd819af66ad1d21a3001c43eeb4189c2e2555b745b8110c47ce3c5e93571ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709fe095d3db571f4630e0e545aa84a9

SHA1
915c753ba69953a63d8438987d4bc332cd53993f

SHA256
14b010803939e1cc878af2300b07d5e94ff91dda47abdde18eea65a8f71c0c99

SHA512
90380b4d5045db14a920dcd65d38878b1dfb3f08baa13c7dac63343052715d6f0e4bf67215e009cc92b4c5cb93c8d68eade3bc8d19ea9b1a31eeec9b21f26164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e9fa0eb504a3b4af825072167de9894d

SHA1
1d76ae245e8160750526cc2c50ee3a365252fdef

SHA256
9df2fcf995159492e31ae7fe4959ad317073586cb5b919387002793dd2b0c33a

SHA512
ed199b6a92ea346d1dab4b0d2b1a4eda0f9061d184875542d622e4e371f0776f3f58d0d4299bc44ca15e4ac0507ea2b5277376f33edb1174ffad5ada30e31bcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b52444b44a37fb5814b29810b2b818eb

SHA1
a2b1b7e97e3c11f5c0691dda44623f62a28b1eea

SHA256
386be0f5554cf71eab33554506d86554bf27125e0dbd374ed6c903fbc1ddb479

SHA512
f9ad1239954de59c8ec0525df8a2165b10f24b851315048adff56931012b7723fdaf73c0d6072eb7b2f28ee10e8dffb5ae1460d61439b02e550e4454ceb7a252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
7bb02efea243da2e5a60e98508dd3313

SHA1
1f941bde96299c819bf9ad9e797b4713c6619fec

SHA256
ed063fd4c826dc79897509ebefac1ca3eacf3a9f716a1ef52a9ba4219a85aeb3

SHA512
3a765ea0acd5a8a247b4c8967eff0624624db41673942134316542ada1e0d011ada3e2bbbf4a568d38b513671653f01ae6fa84df0dba59a7f1535be616ef202d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
337c364637192896ec6b777f6ed6e58f

SHA1
2bb67805cebc5ca98d099b80ce3923ac607bd8cd

SHA256
9f6d2e4e8c54677494f3af314a3e35f19e5895e1ae95ba5be4b4fe7493e151e2

SHA512
8f87b9c7c49d4e7b423619d8673b6e6fce0c5a948eb74799bc63473926104bdde9a32cb30de28f82a0a4a610e315f9847c1faf9fec456c598ab1db918ddc81fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
1fdb2f48729b9dbcc0d51bfaca8d9ebe

SHA1
9e9864ca0d10db66aa081cb6ed75baed07002fe5

SHA256
fe52e88c0d99fb5a9680a90a430ca61fd1a5279c76b98d52bf786c99ee0f96da

SHA512
2c6945775d25ce1766c97d4096c045e4f88c3bf947cf33ba6bd36588027d93d79002432da2228e908f397273d6ced4114cb574327ba66736a5e56706163e1bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
66039e17b9338a7f86d2b1ed8e77d7bf

SHA1
c89ea5aea772d92007408a1704f30e6b05611c5d

SHA256
80a7277a4ec53db282fdbaccadb79301a7e5634677232a0c9da5fb576a7931a4

SHA512
3cd5d2c373a7614ee45544e358854f59c673e959c0213f7b9da1e72d0cf247d3d3e736483a9efe3c14d9e9e2a7c31ada393bd59b5a2a0c6ccc1429e3dde60610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
23a3063148f7bce8c648463ed5fedb7d

SHA1
22e6e98e0947f954982ab280f7a77f1d240cb682

SHA256
0fba30c8186933174b2c395cb7aa254873cfc4d814fde1b4501ed2120fac7f7d

SHA512
dc9a3e0d734c56032198cb3c25ab0dc903e24c6d2261f6aa17d408a4d6b91e1a5ab2c55f98210e9fb3c46c8d441b7ab8c7b9ec5f1b6e1b69d1657a2ac1079ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe57cdfe.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c27d28a6f0e5718d1998959826133527

SHA1
f0cbe9b6a0f01a0139aaf44365082a41a6ea1430

SHA256
60b1fe31d91b101366245f485e753fd07845856e619f9be9d79a83528061ba24

SHA512
b9f1028a1f39fb6d193f29448a39ea7cba8613cd5697bc4254a40e04bc2a3f0f427f22499c0a26344726ceceacdfcc106b50fc2245de182a6e12e28259653450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5f72bac35e2d22b7bf6d793c466aaf7

SHA1
5c8f9ded945366824727991f81de8af5e45f40ff

SHA256
7dfd1f17716be91cf8128b3a6a0996bd8fed4ffa7b78fdadd635b4e76af5d508

SHA512
488a88a2a1a48b4a54b1de5e45949645ef97d145b9bdc0e3b5aafafd003fc1f67acebbb332698ce5bb099f833daf8ad1fd8069954c7b020c27f6d0140093189d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73da5b4518c712c21064cae51238bdb1

SHA1
b4199f9c169a5c38817d0b18115e540f3bea95ec

SHA256
bbe4017e6d2a32c32ee2e0ea97054fcf19a63cae350136d717d4715f984833ec

SHA512
35890bb1ae855714327cb817cfeeeecbec7cd60e07142812aebf0224e2a8152308b4e7fea60e706bfd3a4722c3b9e3857878a843b6edc496a3f3ed44ae06b36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd6cc3cb76555e1af06265ed42f09939

SHA1
0f25e72e3420c97ba5b657c071a31abc7597f268

SHA256
1740ae76e3da1cf0679357aa7e6e4fbe4f259ab02d9eb5afa856ced105d2263e

SHA512
bf2a5208468c8b98cea5ed853b487ca95a98b320bfa5b4cb21425bbe901d7d8973c53283a5f7c1211a4e7331d8bf2e1d37638dbb3a27715438b999188b7de588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8332708c6af6403f483addd7a9ce3688

SHA1
f14dae4b8e11f04326d0feac3422642966be6b8a

SHA256
9197653c8320c0ec59aecf16e8eb00cbe9f5ab87cd925e1c5e0b866bf8b00a49

SHA512
e2d8095684b6ed89dad73f872cc4eb965821568506c04cc47d452f86492074df3525f9affbfaa77e13c3418d61414b3dd43e31c5c485eb15f347ddc45c1180a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
597b1bf1f4d8ba6c8354c6dd702883e5

SHA1
fda8c66b31960779399dc7d806ec7dba3f4a405b

SHA256
766ffd32eebfe4412c71b76716532bcea4765be304da41a9ab60829f9c55845f

SHA512
1e2052ef3ef5d14768e1646d995995607ca9938b671a28b732a5fbc69564d84c54592e8a51632a02ada3643188eb505240b52735a4fc90fba775ff316756afd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6e466bd18b7f6077ca9f1d3c125ac5c2

SHA1
32a4a64e853f294d98170b86bbace9669b58dfb8

SHA256
74fc4f126c0a55211be97a17dc55a73113008a6f27d0fc78b2b47234c0389ddc

SHA512
9bd77ee253ce4d2971a4b07ed892526ed20ff18a501c6ba2a180c92be62e4a56d4bbf20ba3fc4fbf9cf6ce68b3817cb67013ad5f30211c5af44c1e98608cb9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8d97ac65c35acc2a4db41c029f23d1b6

SHA1
ce80016b5268436e332d39de26a1d08c46e0319f

SHA256
535f78b19014b6a4412df37250262332869c74fbe4f63eb80c9a46d507c306f7

SHA512
8f14210be7b8a85ca4edf54c8f6a4a80c9cdb5abbdb3a500463db2225a0c39f89977f523da327e725cd8d1fdb73b055a44900b704f33a8e7ba0797a554adaffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ac2b76299740efc6ea9da792f8863779

SHA1
06ad901d98134e52218f6714075d5d76418aa7f5

SHA256
cc35a810ed39033fa4f586141116e74e066e9c0c3a8c8a862e8949e3309f9199

SHA512
eec3c24ce665f00cd28a2b60eb496a685ca0042c484c1becee89c33c6b0c93d901686dc0142d3c490d349d8b967ecbbd2f45d26c64052fb41aad349100bd8f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13378127059615962

Filesize
4KB

MD5
932d78522dcc154ebeae2eeafed0822c

SHA1
a696be6b26a6cab49dd1127443ff33e4fbe87b46

SHA256
613d8a779c3693c33677cad8b32dde108105a82434b1774e91262d7428f28d18

SHA512
74eea25a02c63370ba4778939f13f8f6dde42f811a6bd659d519e56e6df5929d87b217822ef886fd356fe08f94958395a99f71d2f252334a74b3b5d4bf257280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
56df8ea4b2f599aac921941e9e78e312

SHA1
ddaeee231ecd34a4c58eb1ab7f115f908ee93008

SHA256
46fd4019efc47ec3b6f476b935f605f8f773500db668610541206c6e06d977c3

SHA512
aa9c1b80adfc6e0632d509d275a3f78bea974f8ab72224b2b396dbbe7fb920e642d2cac3cb4b2c87004776edad069c98e790efd65a67f5df6a7c2203eb438499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
9b865c4d16f04b615793bf3785870b85

SHA1
4fb5446a788a55cc4c3f33024f0133052e970154

SHA256
412f53f60711c2b90985dd88246cd551239444da806ffa9174ca8b2d177a4c0d

SHA512
9243f39ad7c0b2b87c839a1274adaf621e7aa9910508b107ffb05d692f72e8fcf08a818082fcec4db42fc45107fd4bf14c88c11ba3c5462c667d65628973b82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
495b4325e598da952669d0edbea57a1c

SHA1
2db0be367abcb5b280b74ce2cb80fe9a466dd3d0

SHA256
232e22b2922e36d3fa007883f0da0598814073ebf173745ff6412767110d28f0

SHA512
b1ac83670f21fba3f56699ed2157e90a1cd880031cdd47e16af81d6046682fae6e61421330453d4b705521405566e70616074b92908cda622188a4141bbf7359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
40d023754b38aa6b5c280a23358b25d9

SHA1
38a6d980b82ae1ab4b8c4c5a0ae76f70adc166f2

SHA256
441a2766d6c608bf228ac5fea0dfc7303011ff5fc611eb9d0dcbf620ade5432f

SHA512
c1aeca47ca1b206c1b6483bd0c70ee2732a059422ef6dd9445243031ff9628c9bdab60fd642564036b652dceca3e7fcde1fda5de7facb97df9ef977fa2d5c6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cdef.TMP

Filesize
1KB

MD5
308dc392bf74a2798025c7b9e67c7af3

SHA1
c5c3f70c17e57a7ecbdd5e952caed658037a74a0

SHA256
8dd013b1a6c30baf2666686f5832bbe627d7a1dc2a3e78eab0bd2e08d8a7911e

SHA512
7df58a469d181971626325de987a707d02dbda6d00b852da9b713b5a111f95b87362835c959d6351628303c4b9a8c8c229744067e0f8780a5da23dada1aa433d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
066d3537758c5c946d0792dbeb85ffd7

SHA1
8f6183e4f1836c7b9b044823f65c323aaddfcc54

SHA256
b65950d693da431a4e8647cf067a8146478859f9a50ea374ce6ed4f642df787a

SHA512
1f21fe9a5cd07d8039bc61a79aaff0be519fa8b7ee45d8484c281454b9432c01788ad915779336159f277d2120270855d45946d21e7d11326830aaa994879074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
402ae1809573bfc8b8c46d44913613f6

SHA1
69fd3593837b469a6758a6982baee4e4b8e8db0b

SHA256
945c6a8e33b11630f73f1a2487146ebdd4b5af4cb61ee01684a00464ccb169a8

SHA512
d749f27f3eb8b966a9e82be22c5647b3b3852546ba53614189ac2d2b892976af35192c9d7498791539de70af700203f134c2311b1e7a2d61abc97ee5fe00b400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a29a520d1a8dd50d44deaa848c616625

SHA1
3a0ee8628c3a96a58d088b3b21346944583e3c93

SHA256
b681bf5379a4e1d48207873afa935109a6ed42e67994886091a9fc1dedf9a327

SHA512
0846b48425111ec0c1d1999d6d6c290ffd2561f5cfdf443c74ef4d5f26a4e24957d1f12eba138b7dc27dec19624820ed2efe5c22ad4e6b3537fd1430cbcf9d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d08683422a01fb23bea4cba735aa6b8b

SHA1
ffccc48fbd156584ad0e3d9fff5ad1ce81a93d17

SHA256
5c3fe0bed26a0fb96a541302d98707872d8316ee62b859f0063f6d61273a3ea1

SHA512
a5060f1068ef42bf6bced01c0caf24b991c4ae593e1bc09178d60c69c00a7b01f54df88ee54a7e2ea1fb66b0cb386d2aa8e388fd153b40c26f84d9950897d8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0507874cf2a8758a51dec02487c39cc

SHA1
0301133188f18e192b6ddbde2a236f2ccfa36fcc

SHA256
efa9424d2481c788868d133ea6e4c5a2fe876bb4108963e4ddcc0df37e07becb

SHA512
a84f47093b44095ee596719b75fea3cd7660d463c3f2f55df6ce38a125e85fc9e4f3fd3e0187d12dd06c104f680fef1ec3e56e360005285e0dd4327f6a79f0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
6a3a60a3f78299444aacaa89710a64b6

SHA1
2a052bf5cf54f980475085eef459d94c3ce5ef55

SHA256
61597278d681774efd8eb92f5836eb6362975a74cef807ce548e50a7ec38e11f

SHA512
c5d0419869a43d712b29a5a11dc590690b5876d1d95c1f1380c2f773ca0cb07b173474ee16fe66a6af633b04cc84e58924a62f00dcc171b2656d554864bf57a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638343870221005468

Filesize
57B

MD5
3a05eaea94307f8c57bac69c3df64e59

SHA1
9b852b902b72b9d5f7b9158e306e1a2c5f6112c8

SHA256
a8ef112df7dad4b09aaa48c3e53272a2eec139e86590fd80e2b7cbd23d14c09e

SHA512
6080aef2339031fafdcfb00d3179285e09b707a846fd2ea03921467df5930b3f9c629d37400d625a8571b900bc46021047770bac238f6bac544b48fb3d522fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
a1dd28b98ee20ee465092ba8f12f32b3

SHA1
13cd0c453878c7f8da80d646798d056bec284030

SHA256
f7c213297919472e7be1ed75587d1a2431660bef28c241775bd2e635659e98f8

SHA512
bc5ca7fd6ac443695fbc8c4a5cf8e005690b03a726918fa13c832a8dab2f7f3f19a7ad9252a732b1d26b2329e55c923053568f571b7ae7e2e04c929a3575a9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
8e8e1e2bd02add9965c8767485b0fb56

SHA1
7471cec266d914ce982f721637ea3c13b2272a74

SHA256
59403ef10ec23e33b30c76137601863357b6712a78d7077854df36803ea40963

SHA512
55d22b9e414b16e08ed2d54f4a721324400bf35d81fee53099b945c22b39496327fafe7f5b59ed4cb23c32685ff3f999a298dfa5522821b2d51bced12ea7c95e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
cbbd0cdf4ec58778f8d28e3dbaa50c4e

SHA1
5a68e6b2fdc85019f2e021346696db4b99dcb3f2

SHA256
db0ce446d094c9810c80ba5a1e6b0fea2102f17b78c60a13296f55759db08281

SHA512
69732bb84735ddeae8b52ccdb0c41ac7fe9e3ae93615617f96491b7316e0107d505687e90b3a0a3d579d6397e41b305f9b6498043081bb7d8e2259da57ecd480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
c85ed73e3b245f8e44bd61539c33ae68

SHA1
3616782bb72985e1deae9c58f03f9e7e8e08b633

SHA256
7b7af4f3313cf2a842c82cd1b345f1ec7b2eae9263b27ec6dcd74a016a1d6b2c

SHA512
c032307561137a10a6313847fd0a4212693dd332e19b936fc84dce028c557f522ee179b4051d14cc38e3b43726bce0b3fdbf1c2185ef2f6e7c1aed8398e6b5c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
c4c5cf321245f363486a0137d9befd07

SHA1
d9ae1394fc5874530e23ae5de2af71f665abb01c

SHA256
4a115299862a4b6d2802c76f41aaf4a463a6b5d98cb0fccb6c5147e6f1436325

SHA512
be69ba6060e86c71a5da7814f8a0dcdd94667d9c6a5d7fafcecc9a2726258ddf83742d264d5b7b47eac24d8d7d2b4dce9bccc6c98274e8dffe5c70c12b98e146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
87a48b5b89a2f67b10a67be9011c581e

SHA1
0f8c6ed099d39b8422fd37703c452ea1629d6a44

SHA256
c1b5f1f7b48084b978d59ad5bbed980edd7f4891208c495c688f36de616eacc4

SHA512
7096cb9b0793ce85b1ba0510e904cf3315d37c73aaefca7abcfda0100d96f6550a11f27a8a6ae9f57d392f5a0bdf93800a92475c6610b5bcfbe8f6011182d0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
2d4deaa7a267ee837e51e37b70f69d8d

SHA1
d169c60063dfe57f69fcf655888b85dcf501b51a

SHA256
c0bfb311df37635162248720ecc904ccfd5f02c0da6ec8e44ef2b17b4c31d637

SHA512
3df2df667ecd7490523b0c57ecc23dd8df19847ff0d7ce619b12615425304720984b49d04816189a826f1d56835dadbafbbc4e9a696012ed8cd2e8e840518250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
32db928598b93a8f38040aa2f7ddb1e7

SHA1
f95d4a17392953b31cec733a0175dc43bac76de1

SHA256
729176920b20f3c741c30905dc5f14ac0e2457cccbaae4b4711ed3d87b9a947a

SHA512
18cedfdd894f7ce029146dd38d906b2f653f9fd8fb9e7dd7dbace302188bc20aaf3cf66585f145a45115301240f981dd85722ae0141dc8a271c6dc6cb5cbc208

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_id0rl34oxreuuoxkuh1icsh0qae0uc4o\0.5.8.0\user.config

Filesize
565B

MD5
ec542348006c0bad71e79487057c0ad9

SHA1
d74fcc55591a1b5d71166c04e50e88ddf7285adf

SHA256
f376aca33c2a9497a04be4aa5155bef67bf6cc54830dcc451387b313631f9626

SHA512
4d697d26ed7a77d964b3ef67fda101bdefdc906393103660fbd0523551f893249bf1daef13bd28c657bbbb7adc975836d01f0dba0136356fade033cb3949983d

Download Submit
C:\Users\Admin\AppData\Local\Server\AsyncRAT.exe_Url_id0rl34oxreuuoxkuh1icsh0qae0uc4o\0.5.8.0\user.config

Filesize
319B

MD5
f71f55112253acc1ef2ecd0a61935970

SHA1
faa9d50656e386e460278d31b1d9247fdd947bb7

SHA256
d1ad588a08c8c0799d7a14509f1e0a7ae04c519102ed9d328a83fe65999e6179

SHA512
761b5c13e39bd4ae21d298084bbe747ae71c383fedf9a51fd5e9723a8b3b4547de459d82bac7f3f8f3bfc11cfb0528a4f1057b51996d7d046583109a53317b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\121kinet\121kinet.exe

Filesize
3KB

MD5
ca33923be7c16964739fa999b2826e11

SHA1
a8d1e4351e9cc693db469cbbec5a831f516f3cf9

SHA256
33613fb319533f7f99357b85691a860839e46695ddc68a3e2858df7c53a99a4f

SHA512
fbfbe7ce998f091e8a7467de113a2f08ef32d89e4aa8f9c6544e7f231984c4f9943da8e6f8673478ff64c88c01a5aa00c072fa2b88c7299bf14bd8a71b708829

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4E12.tmp

Filesize
1KB

MD5
ba89a0605ae666904c62fc5b87fefa32

SHA1
db6de7e73157f1541165fea80078102e916e79e8

SHA256
a813cce1cb1a16d5112626e7cb36582a86cc9402b9063c8192aa59bcc391bb77

SHA512
dbbc8f77aa207a1209907ef5b2e3d83f1b0fdf1585d9ee0e3e4be2d3101066c0bceeb80deaa8e1c0132dff68013991d354530f40d28ea1bb7805bd3ac3c43eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBB33.tmp

Filesize
1KB

MD5
a3539925aa35d28e694a8ff818c756a4

SHA1
67cee6969a4b5730c1b779f204b65a8522dde592

SHA256
76b26b0bc0fd098cfe82f9b5f25f700be66aa62df0336013fed9d1c9edd6807b

SHA512
a5920093966aa19344c9539a23ef133e9ca40d01c36097e6d08c2d3552f7fc64dcfa189f696ee0df3074f9fc961cb07776b800fb69a603869f0bb9686960b49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbhzspdg.vbb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ehuyuzfp\ehuyuzfp.exe

Filesize
3KB

MD5
6cfd5fd33a7a8b1cbc0ef9d102ca9d54

SHA1
8bbdb03a144f303105df158adb4a57811ef3db15

SHA256
b01985383edf42f23cb9d56f685e81988eb65c1fe8cc1240947668e7e6622852

SHA512
4d51bcb1fb04ef041a89ebb548c7047f8b69e8143b35d660cf53c0a343aa69b21b0f6271bffd6909781c3e60c34c0ec514150207654e5c37f32dc2af48a447b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp24FB.tmp.png

Filesize
695KB

MD5
ad8a7bc293ef1acee526beba6ff77095

SHA1
639df98db99bc843696ac05ea87278c55620cfa5

SHA256
a3249a359fb4ea237208b020770cae8bfb30ef87c641c3c2fb6870dd1b5341d8

SHA512
c445c6ed076a336dcbb9112e0171deb9c6180126403d29e8e19f14bb8232e6fefde76c8daa60530cfe4c2eb68f64b04c7dcfe7cc84c6e432e7867031bde2065e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
90998d1fca25ef56d8ee1e75acc0f174

SHA1
56469357784b7b10f55d87187d648868a5a8d4b1

SHA256
6ced3c08dc54a63e2238cde2e1ff27c9fc614e4ddaab248bc1902c544c8d407a

SHA512
da6b9ce65faf7ca96b36b77ae90eaba8000fa56da49b13efc05d772b51b2f3c427d06cacf930dd1573f8be26e5494def3ccbcbefee0f98b4e0a1b8d2ad22471d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
a126fa34ef019b1b69a23fedce547f8f

SHA1
0d57e289358ce590e0d7c0b5b868d2a663aa68a6

SHA256
46b56e37b041e874946aa63c3f441faac3b866eb2b36f879a39e1ef390fe7cd9

SHA512
6dc60ef33a27484a998fbbbfb653403baa531293daf3b0f4a75577cae43b289d708a81e910c427495ad7da5aa6f11ae78c8547a6060aeed9348a80e35600d9d2

Download Submit
C:\Users\Admin\Desktop\AsyncClient.exe

Filesize
47KB

MD5
3c6f463a42ee873ba760e3289f9bebf5

SHA1
82ec0f356d12ccd6fa2665e4c2889199e95c6963

SHA256
fe97f0d74de7c9a029d6c6a64c2cfcd5dc4d96d491d4552167806d24680bc825

SHA512
5aee8dff43567dd90ce8a7ee9648ea9b00a6c49e83733cb7dcdc46bec3fcb8eae1f2c9ccc152024573525345f21c5c851e17ebff49d58b5ec0b71b23b45bfa1f

Download Submit
C:\Users\Admin\Desktop\AsyncRAT\ServerCertificate.p12

Filesize
4KB

MD5
9df2c20a697d6f099a9cd7b67cbd5f10

SHA1
e65b1d353c3dae5c57584fae107f7b0ef333c4df

SHA256
5923589833994d3bf2916fa8503f579f3c1148f56b9e2369cd1cafeb12c7d97f

SHA512
6b4e5e0a4060f1122c9ac4e40273f20a38749bd44f27e7e84cfffd0e48a31f052dc593419aa935aabaeff3646e1c68556a268b2e482e18898c85917e1032bf72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 668197.crdownload

Filesize
6.9MB

MD5
30b1961a9b56972841a3806e716531d7

SHA1
63c6880d936a60fefc43a51715036c93265a4ae5

SHA256
0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c

SHA512
9449065743226bd15699e710b2bab2a5bb44866f2d9a8bd1b3529b7c53d68e5ecba935e36406d1b69e1fb050f50e3321ef91bc61faac9790f6209fec6f930ed0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\121kinet\121kinet.0.cs

Filesize
300B

MD5
a85fa53c112b4e364fa6b963a545325d

SHA1
27543fe26aa3344a677f03d5d892a543f3a7a7a0

SHA256
9048696e1de76c06e31a701b2b5f9a32361c34fb63ab1cca8574330d8152c121

SHA512
7aa25cff8c813440b7dfe1146cbe7a1213bedda48ddb819ae506616c8d97a8377dcd7fbad4b67dfd1bf5f130ba622beb7b2a546ccd18288705806b483fa4282c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\121kinet\121kinet.cmdline

Filesize
334B

MD5
ca8b4e0e4951d91da3f19aea2e4bd0c8

SHA1
170f1ac639a2faa3ca7e7f92cafe1fbd1d11068a

SHA256
5806a8cab0bee77a731ff8b982f16880220e2a9b271cfa78e9970ce93ce81cba

SHA512
d2632adbc6487c13edf59592da245befc21a565fd788d89296478f3c32caa55aaa6a516f8109a57db8d0fb29a89432746322079987c1c0e8c988371e89e817fb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\121kinet\CSC40C50F256F4D4C6F8EEEB331C1ACC18E.TMP

Filesize
1KB

MD5
24fb90c9f8300efc39184f81122b753d

SHA1
131409c5e52626907f03dd86007c820d52b7fdb6

SHA256
69a2cc85cba10ebcbacd56efc79c73c24bd755e87e4d5dafce8e81315b381c7b

SHA512
67732d85e4013f90ba2b57fc50401fc05964d2320878621fc37fb25562eb8c9351929f2311838e0a0f7c1c75722d298c41ed8ff17c750219305e05ed6216e1b1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ehuyuzfp\CSC7604B16DC634B04ADD94DF7F440FDB7.TMP

Filesize
1KB

MD5
95335f67ade0f6f79fbbfedea56a700d

SHA1
6dd560f143fee9b8b7e3b90183e86125cf4319be

SHA256
425d390e2342d3c180a4abc6c81e2c562b686bcda0b01fce726d70b7a07e2b45

SHA512
fcec99baae67fe4b4c0b899aa8442bf715ef5cbdaa622a8565f75e03782a0632906411a4d7a843ba6543941855435beb8315ed5ede013ef67c86056dc67c22d8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ehuyuzfp\ehuyuzfp.0.cs

Filesize
312B

MD5
f820c95f11bf7d8f289ced1859ca6b95

SHA1
d9982f1b2c67fad6de1bb0a968ba87f31c5a60c6

SHA256
782235c5cff6976f848a593eae7ad15c339793a9c288ff277c2a8667e994cbe6

SHA512
c548a193de161c0881847d95f80dd70aa5862a53c275b6d81df6ace20a64889f981848817925d49a1f5a7281b6614873d44f26d91852bff926954feefc97a224

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ehuyuzfp\ehuyuzfp.cmdline

Filesize
334B

MD5
a8bbc1451e22177b32c4eaf1b4509ffe

SHA1
a0169b0a6d6c72cd84c072295755f1acadb8f3fe

SHA256
685779b3365877422ba572710df0e220b65cd1fe7dfea933c98e5bdd9f7b9f88

SHA512
7a1baba5f6e86e9cd0099125b6c54bb91e60ea263e1b41370c68f50eacc6dcfaa283ce2e07426eb9348728db13239c9d05357f67574e1272917cec5d728068f8

Download Submit
memory/1424-830-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/2216-800-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/2608-756-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/3672-592-0x0000000006E10000-0x0000000006E72000-memory.dmp

Filesize
392KB

Download
memory/3672-596-0x0000000007360000-0x00000000073C4000-memory.dmp

Filesize
400KB

Download
memory/3672-549-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/3672-552-0x0000000005AC0000-0x0000000005B5C000-memory.dmp

Filesize
624KB

Download
memory/3672-553-0x0000000006110000-0x00000000066B6000-memory.dmp

Filesize
5.6MB

Download
memory/3672-554-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/3672-556-0x0000000006F40000-0x0000000006FB6000-memory.dmp

Filesize
472KB

Download
memory/3672-557-0x0000000006EC0000-0x0000000006F22000-memory.dmp

Filesize
392KB

Download
memory/3672-558-0x0000000007210000-0x000000000722E000-memory.dmp

Filesize
120KB

Download
memory/3672-559-0x0000000007530000-0x00000000075C2000-memory.dmp

Filesize
584KB

Download
memory/3672-561-0x00000000074A0000-0x00000000074AA000-memory.dmp

Filesize
40KB

Download
memory/3672-595-0x00000000072A0000-0x0000000007304000-memory.dmp

Filesize
400KB

Download
memory/3672-563-0x00000000069C0000-0x0000000006A52000-memory.dmp

Filesize
584KB

Download
memory/3672-576-0x0000000006A60000-0x0000000006A68000-memory.dmp

Filesize
32KB

Download
memory/3672-590-0x0000000006AD0000-0x0000000006AD8000-memory.dmp

Filesize
32KB

Download
memory/4248-597-0x0000000004E00000-0x0000000004E36000-memory.dmp

Filesize
216KB

Download
memory/4248-613-0x0000000007640000-0x0000000007672000-memory.dmp

Filesize
200KB

Download
memory/4248-628-0x0000000007810000-0x000000000781A000-memory.dmp

Filesize
40KB

Download
memory/4248-626-0x0000000007DF0000-0x000000000846A000-memory.dmp

Filesize
6.5MB

Download
memory/4248-598-0x0000000005680000-0x0000000005D4A000-memory.dmp

Filesize
6.8MB

Download
memory/4248-627-0x00000000077B0000-0x00000000077CA000-memory.dmp

Filesize
104KB

Download
memory/4248-625-0x0000000007680000-0x0000000007723000-memory.dmp

Filesize
652KB

Download
memory/4248-624-0x0000000007620000-0x000000000763E000-memory.dmp

Filesize
120KB

Download
memory/4248-614-0x000000006FC10000-0x000000006FC5C000-memory.dmp

Filesize
304KB

Download
memory/4248-629-0x0000000007A20000-0x0000000007AB6000-memory.dmp

Filesize
600KB

Download
memory/4248-612-0x0000000006490000-0x00000000064DC000-memory.dmp

Filesize
304KB

Download
memory/4248-605-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/4248-611-0x0000000006440000-0x000000000645E000-memory.dmp

Filesize
120KB

Download
memory/4248-599-0x0000000005620000-0x0000000005642000-memory.dmp

Filesize
136KB

Download
memory/4248-610-0x0000000005FA0000-0x00000000062F7000-memory.dmp

Filesize
3.3MB

Download
memory/4700-840-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/4844-746-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/4888-766-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/4896-767-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/5360-790-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/5520-810-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/5684-735-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/5684-745-0x0000000006E80000-0x0000000006F23000-memory.dmp

Filesize
652KB

Download
memory/5684-638-0x00000000055D0000-0x0000000005927000-memory.dmp

Filesize
3.3MB

Download
memory/5684-698-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/5924-820-0x000000006F1D0000-0x000000006F21C000-memory.dmp

Filesize
304KB

Download
memory/6120-517-0x000002E650730000-0x000002E650856000-memory.dmp

Filesize
1.1MB

Download
memory/6120-504-0x000002E64F8D0000-0x000002E64FB22000-memory.dmp

Filesize
2.3MB

Download
memory/6120-502-0x000002E634CB0000-0x000002E63531A000-memory.dmp

Filesize
6.4MB

Download
memory/6120-505-0x000002E64FD00000-0x000002E64FD0A000-memory.dmp

Filesize
40KB

Download
memory/6120-506-0x000002E64FCD0000-0x000002E64FCE2000-memory.dmp

Filesize
72KB

Download
memory/6120-562-0x000002E655120000-0x000002E655178000-memory.dmp

Filesize
352KB

Download
memory/6120-507-0x000002E653AA0000-0x000002E653D20000-memory.dmp

Filesize
2.5MB

Download