asyncrat | b05a673d7e1071375cc3c5d595753379c8f5782d147e18732def1775ef33e82f

Analysis

max time kernel
33s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RedLine stealer_2.exe
Size

226KB
MD5

97faf1e3eb855bf6e8a96615b2b094c8
SHA1

19941236fbb40357a8d8ffc9b26f6208415e7bdd
SHA256

b05a673d7e1071375cc3c5d595753379c8f5782d147e18732def1775ef33e82f
SHA512

a71cc8a7527444697f4d4117b880efc8d492f42f7e70f3efa0a741403577effa15013c247ca62b68e7672388f0fa8c6504a3053e4dd09535d497e3e179d1928c
SSDEEP

6144:zUU4EEN/9GWKfmEK+fBGt4t9Sqye5cxUXpt0GvVA:AEENoWKXGt4tke5cCT

Score

10^/10

asyncrat default discovery persistence rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

odvuhfivfndnrco

Attributes

delay
1
install
false
install_file
Nivida Control Panel.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/P0ea2dX4

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RedLine stealer_2.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RedLine stealer_2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rundll32 .exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1436	svhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nivida Control Panel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32 .exe"	RedLine stealer_2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 1436	4984	RedLine stealer_2.exe	88

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedLine stealer_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
1312	msedge.exe
1312	msedge.exe
1892	msedge.exe
1892	msedge.exe
3352	msedge.exe
3352	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
4984	RedLine stealer_2.exe
4984	RedLine stealer_2.exe
1704	identity_helper.exe
1704	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	RedLine stealer_2.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3624	4984	RedLine stealer_2.exe	84
PID 4984 wrote to memory of 3624	4984	RedLine stealer_2.exe	84
PID 4984 wrote to memory of 3624	4984	RedLine stealer_2.exe	84
PID 3624 wrote to memory of 1412	3624	cmd.exe	86
PID 3624 wrote to memory of 1412	3624	cmd.exe	86
PID 3624 wrote to memory of 1412	3624	cmd.exe	86
PID 4984 wrote to memory of 1148	4984	RedLine stealer_2.exe	87
PID 4984 wrote to memory of 1148	4984	RedLine stealer_2.exe	87
PID 4984 wrote to memory of 1148	4984	RedLine stealer_2.exe	87
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 1436	4984	RedLine stealer_2.exe	88
PID 4984 wrote to memory of 4256	4984	RedLine stealer_2.exe	89
PID 4984 wrote to memory of 4256	4984	RedLine stealer_2.exe	89
PID 4984 wrote to memory of 4256	4984	RedLine stealer_2.exe	89
PID 4984 wrote to memory of 1172	4984	RedLine stealer_2.exe	90
PID 4984 wrote to memory of 1172	4984	RedLine stealer_2.exe	90
PID 4984 wrote to memory of 1172	4984	RedLine stealer_2.exe	90
PID 1412 wrote to memory of 1044	1412	wscript.exe	91
PID 1412 wrote to memory of 1044	1412	wscript.exe	91
PID 1412 wrote to memory of 1044	1412	wscript.exe	91
PID 1436 wrote to memory of 1892	1436	svhost.exe	97
PID 1436 wrote to memory of 1892	1436	svhost.exe	97
PID 1892 wrote to memory of 2688	1892	msedge.exe	98
PID 1892 wrote to memory of 2688	1892	msedge.exe	98
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100
PID 1892 wrote to memory of 888	1892	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\RedLine stealer_2.exe
"C:\Users\Admin\AppData\Local\Temp\RedLine stealer_2.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      PID:1044
- C:\Windows\Temp\svhost.exe
  C:\Windows\Temp\svhost.exe
  2⤵
  PID:1148
- C:\Windows\Temp\svhost.exe
  C:\Windows\Temp\svhost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svhost.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd45746f8,0x7ffbd4574708,0x7ffbd4574718
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1524301398628001722,418723764056996317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svhost.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbd45746f8,0x7ffbd4574708,0x7ffbd4574718
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11823428300864887220,10213859758797436485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:2584
- C:\Windows\Temp\svhost.exe
  C:\Windows\Temp\svhost.exe
  2⤵
  PID:4256
- C:\Windows\Temp\svhost.exe
  C:\Windows\Temp\svhost.exe
  2⤵
  PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d81a86f347e1cb0121d5db5ec9f4b6

SHA1
9a73320b71249f92c68761426cc73a284e88748a

SHA256
5d5bd53be8d1a2b10c365e1a025ef19b5ab40c9ebed7eddfde924aa635266b37

SHA512
44a64a73c879c249d27b0d06fdf74309fb477e8b7adb227acbb14a8acb8c07b7729b0ca84eb531fb25d8bef20ab703ccfe1952dea8b1f4138b668770f3119602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
05e8266c7da504f736e2856c998c65fd

SHA1
b2f4f5178b44096c5ad9932491c0f9ea33e32275

SHA256
28e6398962fcffac7098a6743a7669a3ac762275331618435486320c299823a9

SHA512
e2521f11d939eeb8430a9a5d5b16ad54e657460e292111d9e2296d5514eb1cd92f7219112612a686660bcda6bb5f6dc8cca17102740e7eff9da8cc1454ba5758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
ca3bce1a57df47962a76efccbfd076d4

SHA1
f9a793b0fc42a1051da4355c626b5b277d792609

SHA256
967657edad6658765a9c26d6708a16f1d9819a9bb3134415d4eb2f03974e1d46

SHA512
16c4e298e1ee9f8a5705abfc15d9269af247b298050e47111676915f60a95b5d96189fc1b095dcb60e670eaecc83fdc6c5996ac19bdbc7bd7a40bd2be0d7a53d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
a32515cb2b62303971fe8b153bcd68d9

SHA1
c6286fe8628d199ed953893ae70a5f3c09d06882

SHA256
f0ed2f028b3e4dd36567ffc9e3dd86af8efb4f6c941a25cd77bc2d0e0dabcb16

SHA512
bfa5460f4493756c1514040da2f12671cc2a7fdc5f628d08acb59a912e2b3e63de5752890d2de0e45e8d3cfe45341e762a965c5b1760cfef727b28f185603113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
39c374e678e9671a99646805ba186902

SHA1
d532b36089c09e93ead6d5da405f808d66e5e157

SHA256
4d066b075013333f8e58fdb241d3c92fc86e2bdea624c0b6429dd9598a78f142

SHA512
34bb43abbe1294437d6fa3931e21143180f2ea6b0767a2d86cc66694e20a5d62c8feb110595f6bdfe8a5b36090e58c24f5266455243d70f5cf9e663baf56a97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
cdcd969318563cece9d671941873968a

SHA1
98b551c9ff9b859ed255c2b974f5fc37a2837d21

SHA256
c4fb11b7dfaa36ef05843d2bc4306a5f3890d3d63f5176da42a32cc7deb783bc

SHA512
6ccfd3e43d99212a5c847ac1eb65e21dd938066927af8af386c6062a9a1bfc350d2c300f9188922375489ff25677c1cec23755405d0b075491826c48b79c51de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
0cccccd82d68d5ff076e1bd047436ec8

SHA1
0b9d6ebef9ac1c03f8138e9fc9203f9cd69d2a73

SHA256
0e9d24e58133fdae2fe766ece9358afdc57da1568485bf36182851b6c1291246

SHA512
84c357d75e1b7c25249ef826bf5ea9ef4445f2d4f985ae7128363421ac28f1cf438256cb40cdfd2fcf9ad439900dfc7796f9ab850e0445dbbfab5c23f29575eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
487KB

MD5
831a0aa25af2c60a7380ea75c321d930

SHA1
140ec306c24ab6f348c4dde5900b219d817e2026

SHA256
8cdde5daa52335c0a4e416f6fc22aa80744207a38fc276bd65341c2d2e903557

SHA512
0147937b2b2cf9bbf7e8dbee2d598e156c6ce4ddff224b3dc48caed96e89038ecdff1ace743b82fdf6155c40b674f4b1983693dbe45c39898487d3b7be258161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26f1a435530e3442_0

Filesize
243B

MD5
61aab3c05513c821f35916ef8140d6e8

SHA1
e7d7676e6478dd43a0bb82c9570feae627a77957

SHA256
b21fd244693181a9d256baf0495c8c444365624d2e307aef6e8f4c9bc02cf753

SHA512
63f33730393dc383e68d6c2bd1df4da8470cc647ce84bb1f6da0820e12e07732dda34578f368866de94243a9ac5d071bed77c55de0eb4326005dc292dcc34a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
224B

MD5
565d581c0a3d3c43a9896a8149ee4591

SHA1
76e35f395c752cd8e8ffc5f364a4aa93e6ef142a

SHA256
9e04c7de1332cea2021a4c4df91e0a9dcc0a39a2f01a27e333eae021da4468c7

SHA512
e71b2f25a2239e7be61af7531d2c15183df2bb79f5040f19e96ef3d09e85901c6fe1e9347694223181d97a90d0344619e0d7d1d1be3ad2b276fbf9102a846d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e91da4b52bb26ef3_0

Filesize
249B

MD5
f9c43bbbfcbef3184db5114ddac062f9

SHA1
877f1b1f012e364275f9b0829d6389dde39f536a

SHA256
91f49135276e33039c6031033d912fd5c3866298f305bcabe1c709c839b9bfd8

SHA512
9d1f00ac23b1750b299ffe3cb739eea905126693d4617086413a09b96d957922b8b2745dd597574f1363146cd1ce6495bbd3589a8c190645f653825fe74a1b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
221B

MD5
ebb729decb5b76b183b7f7466193d8c5

SHA1
52dd8b192e123d8fd3f171cb83c7c407233c0813

SHA256
bd0b7a032c5561c8a20f73b96d47682dca1ccc2c7e6c5d76390f57580fa33178

SHA512
6d2deaaaf6f3f149fe5c449a0023acda4ab723e7c6ff46e5b4060b15487230714957ad56afd29bb2a64560caf7a5632859a9433d8fe6779e573cb4ad6293a8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
77d47df5f8d5a32bd41f36eaa63a2f3f

SHA1
4a82e2aa8dbc01c9fb359d809752fdd9e34d4437

SHA256
ea9adcbf24a065c06375b3b2f20cd75f4d6463d4fe296b0476923a2329ebdd41

SHA512
9d70ec7a12baacb4aeced8713f44d71a4f81de74bdde72c71287d524ff8366e60113689f8b073576241de177fa64d79a00a869ed60c959f0692d4dd51fa326a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7f89e81f6e1fd73aa053144bd49d4f97

SHA1
d8c127cee3ee28a3c0c1453f8e2cd8f1b6648cc7

SHA256
75a08b0f78fc7d09e4ed415f5315506397199eccc84a5b218413a6f85b22a2b8

SHA512
df69731bbc5b1e27dd16cbe43a7ffe8bc1284039b99582a4cafb22b89787b93338395a8b43e75022f79d0c0b8ced2695766b1de7316b0c8b4a5bfc1f9a00d452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
5f1f915fd383276419e33d6e26538b2d

SHA1
9c79e58d775ea19dbfb95fdc4a2eecb99df9a141

SHA256
578d17c0375fef9aa273bec8e81f7ecf0a485dd36f7afff61a9ff9508aefba07

SHA512
c0a80c1a703c2096c46a19c4ad85195e181926365ef5ee40bdaf9a41dbe3d94169e612dfb05e4e504b482861ac13f0466037b94997d4350c25318b5b8a78cfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
b8126dd7baee2fac514cdd6f63cd8055

SHA1
73788793d31da0f756a0a0c8212107a1bb555583

SHA256
fddba8d05e1202d6e36176653dd672605ea3c67d892aa9c2de76ecf80b47f668

SHA512
283936d8aad8698ebc3109d7120d18616a899b817367654c8fba468b1328fce1c948d7ec9da868e1f8c5529f44eb458bf517596780484bcc334ad45b80387992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
194d7ae384ea8c7adee31ed3e2d64e55

SHA1
a1914e63e3c0b4f58dbad493fbe8f8ddc26a3bf0

SHA256
e6569ee2ea16bc98d7724a453b6bc8c3f9e430addc6277f02eb0600b6a82a7ef

SHA512
de09b4b717ba83db148ae0faeceae963ccf571263632a00a3c631945aad7280d1f3a47656d1dec0c173a939614888a9b38b87433688fd6921735ff76796c7af8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
91e5e05bc25a6fd82761968fc5ad0d1b

SHA1
f23b1038f42f002fd5648cae6220cd74611ce5b9

SHA256
ebf47cdbe0513ebd3c55ea9afd18353e7d830b34a14ac0ec06143c489e9bcdd9

SHA512
edc141b325b5e7c6b5eb7a72c8e0a1b6e309082b7ffb2ebb9faef1ac62157b3ac01726bb8155bdae15cb0d06c375b96ed96c65293f6c14a04fd8669fbb1b9bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
3b8333f96dac628df624b307b6a13f36

SHA1
92af407969bfcdddf054cde905111df64b0decdc

SHA256
61c8372fe1f97c52982733ac5403f7c1a060f38ce61429d4d88f3d572296add9

SHA512
2ba6e64ad2764ef99bd40f240426c96fdbad304e3fe4693bba68665b54a245328a067e5a912a5ab63f9df4da1c44fdf1799671f01dc9ab78c38c7027f559477a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
20KB

MD5
c576a47c640b1a9d0e59218068f7843a

SHA1
de5f70934c3bc4ee36605e6cdf2bc7d3977c92c4

SHA256
6d34a10689b7b2b6e04c49f50c5f2fd454b3fb1840a6cd82a3f5191c0a9c94f8

SHA512
c73ae585295883ac6cd9f128e5143f14b8545d296ac975eb32b851acae9a130ffc17b20a097443a85188847fc1f08df372230686c93039be0950bb0915bad962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
54KB

MD5
79761b5fd21634777cff6b4c93a4539e

SHA1
e830310014eae17d62e9eee7a4dc2bcc4c870e6f

SHA256
25bbb2ab5f18ef3bff13a2d5bea9ba7d64b83d232fe57fa0c50dca4fadef5a1d

SHA512
cfee47066bb84dbae2454ec93e6a6f614a0ea9c06f2ca6fef343b2abad3cf75df3979a54b60eb5354862ad1ed00a0bbeb54b258e413da747acad6da1f27d43ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
cdb2bac693c24e445bb8f365c80aadcc

SHA1
445ec9421300055cf66efc88288691c0a4028c83

SHA256
fdda6127fde812594bccdb96d0790f48052b5b9dc86ad1225845462adea4df44

SHA512
a0ce70d083151645963722d18ea1ce3081b8c04d3d49dc6b8c60a71055c651013edddb4c4245a3cc5f0e6c88bd79c4711b977a5e3ed59d689b87d9e65e17e0ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
346B

MD5
172a03f1e073cbc347cb5102d038fa13

SHA1
83a95a02491a4b046ea79fd04ccf6c5c24b29d60

SHA256
b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89

SHA512
2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5aca5d965137215760b594334c0b2e9a

SHA1
1f7170fafd8a30b0b0dcbec98365417704c8da4a

SHA256
57e8293abc6acb9c132d8e7d7234d3b013e3fcbe3bce029a66126f2ff9d89d45

SHA512
3f57b333ed7bad56e02a135a867b9df0327af43fa63a6af01546b96da1201967f540d1f0f6d204fc6143b46f4c1e889f5983e9e3a511ef63d54a4b02a9cf3b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d842ec1c04ca68f18391d378fafd7fc4

SHA1
4cd3ea9f19891d06b3978b9cc2a676b04b2c3574

SHA256
f6a0faf9ab8347c53818d538f3388a27eb82f142bc8c5e19de8c6d967238db8e

SHA512
9095659d719df44dd6c368020510fa534a3971d7a6e2cd7d991afa8ee0d253f44feeb7f851d4a2b4c1f0538e6837bdb128a4e5740b4c87e3b1f44549093a1220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d07c6ec3ff057d97950246c559edf67a

SHA1
5427da0191bee633be9d087c1c90281458605e70

SHA256
6e1eb86374eb5fc1650f52315d88b9b6e0420b4382d163258ff2d0323dab0d7f

SHA512
b5dc56507811da798f10e4ac03dc378cfebbd3b5ebfd71bd2f836405f6ebe1f80c24ff25b989146832aae3d79ab7ef2fd35577dd0a3c2cae2dd9b3147090ca15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16c546c8c68aa7f471802c6244864180

SHA1
a749d745f59df960c0858c547251f5aeedb1a365

SHA256
ffe648a5356466332c2ed614b49c724b57c38ea1a2bf414fb641808d657391b6

SHA512
67e41f3167871c00caba6ed88b120ea00cb6ffdeea2377ff22c6a3b55c864d3653296a07c43cac107a82640b21ecae8a4e64853400f5ffc3a221c07423771a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7552524a58394bbd1c847a4ad3f68b92

SHA1
b8ec430e93a96c7bf78c39eb6a61a2d7b9cf711a

SHA256
c939fe0a65c6b5a046c44258b5ca76f5ac9cae70e014b14cebb5e83f4990e86c

SHA512
8e56fc1bb4cf6eaaeb1271119c8484ff100171b563ea75b53894bea02343e52b1e40f4648b76d3e9b72abc6204b12ef51dcb95ccc00f83f4b901b6e44b441684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
d7decf77270e9937d3531d20bc04a1c6

SHA1
a69f7998108302d20895ee38875a5ccff473a7ac

SHA256
81ac2d33752fbdf511106f11a8d352bfe08a3f5f4428f6b52b5f76007e261d40

SHA512
b98133374cc2d5860bb184b5ba00407ecb166100efbbc087f169da7ca9eb80629240ef8546b11dbb453f9db399ef2b8ff7f4825f9c94ded8b5fe29a1c73ad7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
515B

MD5
9062c4dec89114fff19ee71f80b97adb

SHA1
afb20c4cb297f2af595c776f71f7648fc6440f00

SHA256
c3f226adc7037ca094b37834b90340b5707798433ca879f17ccda05a01fb6dc7

SHA512
172300f9142568ee1df7029516d11d3315f19f3dcbe89d00118931468883735da34f50bac83561808f3c5d85338d1a340c7a964f38380f0dc25ec6f0a04efd2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
ea2025330318446e16babc8bcf65a295

SHA1
03f5d213df6f1f314eb5a23d548dde1711162aff

SHA256
4e83cf3c3f63fadb9a29ecc71a4a2aa1d2bb7473ce034c43793bdbcb09076d26

SHA512
1b48ae7668b49a1b87e20a0acb1fcdb02037af369de40103d6a1d91bf336cdead8b4ff79520bb0e1980682712227d1212e9a9303636fb8364232ecc4af9b48ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13379041378375278

Filesize
2KB

MD5
68a21b867ae54a045d213368ef181c7f

SHA1
4c1a5d7546c796800b04586e753296df2a4b9d5b

SHA256
2437ca8fe71e2073298588995d3b8b3960214e0546d2ab9fd74c789ca6fa1a36

SHA512
712d6e1f974b8c4ce8d0b01415652cd422677962f53ef3ef195ea949e9c6a224e800990aa9dfb14532050736436370bc5d497a48d6741c3a0575554a29052094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
99f7491363995b512eaf10f34d8b43ed

SHA1
37215e4b6b0d6d6c1616c2824d5aacdb728b6977

SHA256
90bfe84074e64bc216f05ba5bea7b545e7608b3a0183734bd696b6f3bacc2552

SHA512
6d3475c5a6920ae3b5f3b45317a3148a6d5865d24455935a921574c2b2191549328cb5886469272914f4922018fbf4a5b638cb041e1453f0429d2bc5a01d1850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
ad3ddfa1ef33cfc5c9a8620b7ea8911a

SHA1
2db8061a3cc3fe75f743371dc21eaf7055ced000

SHA256
569117c071e67151ad2857a2b72a372d72642ba4eb014c8dc7dacc5dbfa1ce7b

SHA512
1198f6d999f348fc45c959f6df5ecd3eeb9a94404316b2fdc1afe93ec2e53109dab9fda1967b499d46723cc2237790ff65658c2cf52e1155a7b1fd5fbb5c917b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
d4639bccedb97724a1ec1d583919fc8c

SHA1
d558aa5588e47f863ecbb46ea1ea2e88c2dc1a56

SHA256
12a7daba6dd9ba877d19a2331464ca8f6773d2cd73579f29204f2180d5dfc71f

SHA512
3fa343842ece0655754cf15f23b7dc2f7b8d265f2c71c40e149754a81337f0abce1d2b8d727ae7818d4acdfcd9698283b995500d36a4af73346042fe47cffd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
5a6d4b648870eab5856e47bacf6fde64

SHA1
9bb4f9d54449a053485cc86c0c774e810a769006

SHA256
646e72c02c751348153b7a30825c34bb6bb15c4051d466dba809de3d8e79f09e

SHA512
2fb874d70ec1222d2aaf116ea32ecfeb78322c59c446e329188a5b993f80a80b58912c5946e0a70490f0daf41720a2ebc7b072af91c7665d3703a8185126f4f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
e29e89b5779e2f3988852fa57d90b868

SHA1
bbeabbacad11c879f925b03824ab33393eafd702

SHA256
b5a3d9ce218d3eb552a67762d661b43ce660653ba8a08e92e5da450682781509

SHA512
438801ce3d452769cc3b1bb45fb8406b93bae3c61175c244bcd7c6d1042079f693e44d93da26e2cdcefdde49864530f20be9379b59e12ff3e05f36421e1c8f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
82a5de4ce6b3e598738dfd596de235b3

SHA1
36aa03c3951510285bc148894a8f0c39df335dfb

SHA256
b750e4abc59c9fffd54c2608c97efafb2c59eb259e427c602b219bbfab983f8d

SHA512
2d7e232ed28e735d5d56d269ac899bcd37996626bcd304feac7f1b821ebbe1fedc1abd5d4af79f1d4f05cf6d6892afa961f4a47a5245dc3d6c74863352346b93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
7763f3b39a21bdd83e7edeed93b97bd7

SHA1
f12f2a4a8bb5a201625bc1ce7b15a79a779a0c9f

SHA256
d80bbf99b1410f0053c3f7f77f4e33de93d8e01e6c0ab655ffee3b6c4aa887d3

SHA512
058d27b04d8ef169ddbcfb792ee29d0bd7c36cb30a9ba0518b645e5139bbac839176ffac1cd50b004e937230193abd4db2d692ef6ebe3b9e7159c3cc6c7734c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
7c4d79f5cfbd5b3c49b075bdf5b4d81c

SHA1
f10aa0f973ccc8e0624fd8384049acaad24ef058

SHA256
0b407b5c4ba6d8420a7fce3d9faf4422e2c4c1d38ef13671136c31b2af79005f

SHA512
97df6f9d1e1cf0e9bf1ee2772078baafcba9e8e2b91e063492ab2c7d5ebf7234edc81dc529195024a703d6e61e7199337a5fc89a28697cd4b72f35e04612027f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
194B

MD5
a48763b50473dbd0a0922258703d673e

SHA1
5a3572629bcdf5586d79823b6ddbf3d9736aa251

SHA256
9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

SHA512
536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e8f8ef5ba29cb9e762bd2f1fa7bae5af

SHA1
909b0c449974ab0f74480a83db05631f47add119

SHA256
09617c431df7ef1c34b4773bb3711b5c5c62f209379f10de0167e8bfdb27f5f2

SHA512
8b0d8fcb836ad39096d6586d81b09f15dbfac30712b40756a0fb6bfb9b5143f0fae523cf865c2c8a29892ae40a7ae1065b40674707003197be09c6cacc43030e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
ad31ef644b82ab7a856b230c2a08a668

SHA1
736e9a63138672c6ed0bafe288e74c41447fcaef

SHA256
4822bcf9ce577b3bb067675cc50d336b60f02e3234cbd1b86200b58fb9dee797

SHA512
673e40c62db3531488d5f64fa9e0b34e529aaf61cff10de9ff56e25cb9e9e10d63a9ee3bffa2043679c6ef75a881eda47833792cef88e032e30cb2eb4a3241f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
14968a63a58885111698068997c86508

SHA1
78a9b860139cdbf73f45da9db3a0de69db323733

SHA256
d08339e02822cca9f8838f780033bff1990d6f52a80f776d35caebb41de5ec28

SHA512
6dfd29d4c515405b41ea189ee0cfe9700f4dd47ed89e979f464953d47bc7a07862cca08dbd58beb89353456d2c761924f6241ac139de86ef57b7b8fccc3e22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
fcbf5f2ba1d6b0cc82b192c978048b07

SHA1
29c4755192966a2372eceec67c146c230781fda7

SHA256
e68a031e2c13f7e37c97972c6c742aa64dcbf28cbcf43611a6cab6622f51de42

SHA512
702323af3aaace30fa752bfa71f9addd55653d19293903d005297746b4f5268f8d3272224543d027e634ed39162db426292f0b2d34f690525f3cc6b99bea4b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84fc4e5a19b084b141a96326862bf48a

SHA1
0619ef43702652aa5eb643983fe95df223249581

SHA256
1a773dbe6be60a0be69c26c90988e7ab7b8feaf1dd6c9c7ed00aae99ef835226

SHA512
b2d693fdc1e0c8547126afc30a22a9932e9d0e37d305161e7261c25df41bcca36cf979850d246336c23acd60271eddc272584346a397d0729c259ee71839fe8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
287bd0b8cd3e48fee450ebb2c6ebbf68

SHA1
42ed1fe2108c3cc0eeecc344df21631e092541f0

SHA256
8e39ae1a54514c440fbd7d1fd78fbed9b3a8c59e41a15027718d73a086d917f7

SHA512
04709a53ca1865db4a791839c24d2ef75e5122b166744a53621d9c32bf4c8e0e741256a300200f548589411a428b715e826c7fe275578a88f9cd8946c430a341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8f829f9-7a6f-4165-a1e3-002047c658b2.tmp

Filesize
10KB

MD5
a3e56f05842fc3b289277ac3ebcbf4cf

SHA1
9282b4dbc1c7559f8d2d4d5dc2639c190ae5d04d

SHA256
9d1d290da8df3f4d83d478b4998568a93838f691e72487e6b37e64d09c736d1f

SHA512
33678b57b0edb21c43d51f547e7941a49d7030e01963f617148053fd97b9c1ccf3399b4148016ede37694b46d8cb780135d9ea0d5dd0dbff240af71cd568bd18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
524fda20094b88239552cec650fd35ce

SHA1
8af34f0848f9cc2e0326a8f59abe69d456e62b44

SHA256
2343771494f678b6aa0cd9c207b33f35f5cfc248f91f771d19dadbf2b31f7b77

SHA512
ba6ae80d3dcb9ce005ca82db69132912aa305447dbc97de085036d4cea88a08f861b9f1da657d25f8f1067ebb6d836822a21f5be381accc394bd0af301ce1091

Download Submit
C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\java.bat

Filesize
47B

MD5
81bf5400486e5da45ba0c6c1399d843f

SHA1
d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

SHA256
d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

SHA512
ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

Download Submit
C:\Users\Admin\AppData\Local\Temp\java2.bat

Filesize
151B

MD5
ed28c618f7d8306e3736432b58bb5d27

SHA1
441e6dab70e31d9c599fcd9e2d32009038781b42

SHA256
d9aa03911260779b1f8a9b046a7ecf7aa87b0f13c762491fe8e06c482bac09a3

SHA512
4257d8839e881a9ab6de6230a9df1e81456cb796eb9ee2361789fa5fe4c81b297ed1c472f91d97bb0b2ebdb6acadb924617e6ffd32fc96d8ddcebf8fee4a7880

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundll32 .exe

Filesize
226KB

MD5
97faf1e3eb855bf6e8a96615b2b094c8

SHA1
19941236fbb40357a8d8ffc9b26f6208415e7bdd

SHA256
b05a673d7e1071375cc3c5d595753379c8f5782d147e18732def1775ef33e82f

SHA512
a71cc8a7527444697f4d4117b880efc8d492f42f7e70f3efa0a741403577effa15013c247ca62b68e7672388f0fa8c6504a3053e4dd09535d497e3e179d1928c

Download Submit
C:\Windows\Temp\svhost.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
193B

MD5
3e6eb49571334bd1b0649507ef0abf23

SHA1
30e857f58e1e01ef359255837e901bba40f36193

SHA256
3e1c3ee178772623f2e276fde7d93d0b86141f6d49317cf8ec8edab6572ff885

SHA512
d5af27d4558569673796b1521b72950b71a041f7c0ae9452541765eacf22acca03afd466011e68075325fa36fd084119845f5077f3e33d0c109714dcaaf638ed

Download Submit
memory/1436-16-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4984-0-0x0000000074812000-0x0000000074813000-memory.dmp

Filesize
4KB

Download
memory/4984-259-0x0000000074810000-0x0000000074DC1000-memory.dmp

Filesize
5.7MB

Download
memory/4984-2-0x0000000074810000-0x0000000074DC1000-memory.dmp

Filesize
5.7MB

Download
memory/4984-29-0x0000000074812000-0x0000000074813000-memory.dmp

Filesize
4KB

Download
memory/4984-30-0x0000000074810000-0x0000000074DC1000-memory.dmp

Filesize
5.7MB

Download
memory/4984-1-0x0000000074810000-0x0000000074DC1000-memory.dmp

Filesize
5.7MB

Download