remcos | c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
Size

960KB
MD5

7caf240db905f259197cf71b03acf888
SHA1

d8d9726a0a67795a01fed368055d9315feada3fd
SHA256

c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088
SHA512

1f9464e14d33bfab44dfc85486bea31126a26929e04eae1159e6ecc886aa79877ca29aa93e614512625000d153e090c06b3b2081f9cbc1e8997ad26e59097255
SSDEEP

24576:GzrpUdcKiEWIXZ4aQJkf1dedJNxkTeGnAoEe:cpKiEWIJ4aWkfjedxkTeGAo9

Score

10^/10

remcos graias discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Graias

185.234.72.215:4444

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
graias.exe
copy_folder
Graias
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
graias
mouse_option
false
mutex
Rmc-O844B9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1416	powershell.exe
3876	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	graias.exe

Executes dropped EXE 2 IoCs

pid	Process
1816	graias.exe
1516	graias.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-O844B9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Graias\\graias.exe\""	graias.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-O844B9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Graias\\graias.exe\""	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 1816 set thread context of 1516	1816	graias.exe	104
PID 1516 set thread context of 1640	1516	graias.exe	105
PID 1516 set thread context of 4144	1516	graias.exe	132
PID 1516 set thread context of 1592	1516	graias.exe	142
PID 1516 set thread context of 5980	1516	graias.exe	152
PID 1516 set thread context of 5888	1516	graias.exe	161
PID 1516 set thread context of 5872	1516	graias.exe	170
PID 1516 set thread context of 1380	1516	graias.exe	178

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	graias.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	graias.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	powershell.exe
1416	powershell.exe
3876	powershell.exe
3876	powershell.exe
2280	msedge.exe
2280	msedge.exe
4880	msedge.exe
4880	msedge.exe
456	identity_helper.exe
456	identity_helper.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1516	graias.exe
1516	graias.exe
1516	graias.exe
1516	graias.exe
1516	graias.exe
1516	graias.exe
1516	graias.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	graias.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1416	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	96
PID 4884 wrote to memory of 1416	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	96
PID 4884 wrote to memory of 1416	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	96
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 4884 wrote to memory of 3120	4884	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	97
PID 3120 wrote to memory of 1816	3120	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	99
PID 3120 wrote to memory of 1816	3120	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	99
PID 3120 wrote to memory of 1816	3120	c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe	99
PID 1816 wrote to memory of 3876	1816	graias.exe	102
PID 1816 wrote to memory of 3876	1816	graias.exe	102
PID 1816 wrote to memory of 3876	1816	graias.exe	102
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1816 wrote to memory of 1516	1816	graias.exe	104
PID 1516 wrote to memory of 1640	1516	graias.exe	105
PID 1516 wrote to memory of 1640	1516	graias.exe	105
PID 1516 wrote to memory of 1640	1516	graias.exe	105
PID 1516 wrote to memory of 1640	1516	graias.exe	105
PID 1640 wrote to memory of 4880	1640	svchost.exe	107
PID 1640 wrote to memory of 4880	1640	svchost.exe	107
PID 4880 wrote to memory of 4840	4880	msedge.exe	108
PID 4880 wrote to memory of 4840	4880	msedge.exe	108
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109
PID 4880 wrote to memory of 832	4880	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
"C:\Users\Admin\AppData\Local\Temp\c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe
  "C:\Users\Admin\AppData\Local\Temp\c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Users\Admin\AppData\Roaming\Graias\graias.exe
    "C:\Users\Admin\AppData\Roaming\Graias\graias.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Graias\graias.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3876
  - - C:\Users\Admin\AppData\Roaming\Graias\graias.exe
      "C:\Users\Admin\AppData\Roaming\Graias\graias.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:4840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
        7⤵
        
        PID:832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
        7⤵
        
        PID:1556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        7⤵
        
        PID:4300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        7⤵
        
        PID:1060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
        7⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
        7⤵
        
        PID:5084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
        7⤵
        
        PID:1340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
        7⤵
        
        PID:3840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
        7⤵
        
        PID:640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
        7⤵
        
        PID:720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        7⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
        7⤵
        
        PID:2684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
        7⤵
        
        PID:3876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
        7⤵
        
        PID:4284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
        7⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
        7⤵
        
        PID:1964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
        7⤵
        
        PID:5424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
        7⤵
        
        PID:5512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
        7⤵
        
        PID:6048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
        7⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
        7⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
        7⤵
        
        PID:5760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
        7⤵
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
        7⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
        7⤵
        
        PID:2916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
        7⤵
        
        PID:5748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
        7⤵
        
        PID:5168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
        7⤵
        
        PID:2828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
        7⤵
        
        PID:3444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
        7⤵
        
        PID:5916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
        7⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5989827147858255777,12014004225029811732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7492 /prefetch:1
        7⤵
        
        PID:2232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:2160
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:4620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:1704
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5964
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5824
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5832
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0xd8,0xfc,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad95046f8,0x7ffad9504708,0x7ffad9504718
        7⤵
        
        PID:1612
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
68KB

MD5
0cccccd82d68d5ff076e1bd047436ec8

SHA1
0b9d6ebef9ac1c03f8138e9fc9203f9cd69d2a73

SHA256
0e9d24e58133fdae2fe766ece9358afdc57da1568485bf36182851b6c1291246

SHA512
84c357d75e1b7c25249ef826bf5ea9ef4445f2d4f985ae7128363421ac28f1cf438256cb40cdfd2fcf9ad439900dfc7796f9ab850e0445dbbfab5c23f29575eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
487KB

MD5
831a0aa25af2c60a7380ea75c321d930

SHA1
140ec306c24ab6f348c4dde5900b219d817e2026

SHA256
8cdde5daa52335c0a4e416f6fc22aa80744207a38fc276bd65341c2d2e903557

SHA512
0147937b2b2cf9bbf7e8dbee2d598e156c6ce4ddff224b3dc48caed96e89038ecdff1ace743b82fdf6155c40b674f4b1983693dbe45c39898487d3b7be258161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
89KB

MD5
6c66566329b8f1f2a69392a74e726d4c

SHA1
7609ceb7d28c601a8d7279c8b5921742a64d28ce

SHA256
f512f4fb0d4855fc4aa78e26516e9ec1cfabc423a353cd01bc68ee6098dc56d6

SHA512
aca511bfaf9b464aff7b14998f06a7e997e22fcbe7728401a1e4bd7e4eceb8c938bbd820a16d471d0b5a0589d8807b426b97292fc2a28578a62e4681185556c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
522037f008e03c9448ae0aaaf09e93cb

SHA1
8a32997eab79246beed5a37db0c92fbfb006bef2

SHA256
983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7

SHA512
643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
17KB

MD5
240c4cc15d9fd65405bb642ab81be615

SHA1
5a66783fe5dd932082f40811ae0769526874bfd3

SHA256
030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07

SHA512
267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
4d0bfea9ebda0657cee433600ed087b6

SHA1
f13c690b170d5ba6be45dedc576776ca79718d98

SHA256
67e7d8e61b9984289b6f3f476bbeb6ceb955bec823243263cf1ee57d7db7ae9a

SHA512
9136adec32f1d29a72a486b4604309aa8f9611663fa1e8d49079b67260b2b09cefdc3852cf5c08ca9f5d8ea718a16dbd8d8120ac3164b0d1519d8ef8a19e4ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
259KB

MD5
34504ed4414852e907ecc19528c2a9f0

SHA1
0694ca8841b146adcaf21c84dedc1b14e0a70646

SHA256
c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810

SHA512
173b454754862f7750eaef45d9acf41e9da855f4584663f42b67daed6f407f07497348efdfcf14feeeda773414081248fec361ac4d4206f1dcc283e6a399be2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
62KB

MD5
8ccb0248b7f2abeead74c057232df42a

SHA1
c02bd92fea2df7ed12c8013b161670b39e1ec52f

SHA256
0a9fd0c7f32eabbb2834854c655b958ec72a321f3c1cf50035dd87816591cdcc

SHA512
6d6e3c858886c9d6186ad13b94dbc2d67918aa477fb7d70a7140223fab435cf109537c51ca7f4b2a0db00eead806bbe8c6b29b947b0be7044358d2823f5057ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14b3affc6c0d332b_0

Filesize
1.3MB

MD5
23b0576699fe9da0b1619da8d8fc69fe

SHA1
d1ab42fdcafd8586bbb306852384419dff12f8df

SHA256
abf7adccad5d3e93805a64ddb2444d7ef48e06a8c5cdfb770a8f24858f020fd7

SHA512
69deb5eb1478da3f64747fda72ded4d1b3ac12f1e362eee101fa6524604c1c58341876dc672ac304bf72a71a89ef4069d4a21c5a51782f14bf8c8b340b9c3dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\218e74342a0ee695_0

Filesize
295KB

MD5
efbc714c406683ff39815b53b53d183e

SHA1
8f955014efd7b6a65f9b65abd4dac8a634c60d78

SHA256
f56f2b23737f3a5ad869fd6da9cd8adc2a62eced88a523c07cc4f90e00019b87

SHA512
530ecc3b0419e24995f73f4a1a81601916041cc2817dfde18d9356295aa760372b9814f6d69772849997c0622355cb9042bdfdb9e3bbd72ef5ad2c14eb30864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26f1a435530e3442_0

Filesize
1KB

MD5
43c005830021f16339ae5f0588b764b9

SHA1
9e8577fbcfec92524323ec0294843cf4f5d0cb86

SHA256
44a2406a52459170285569b66ce7a75c8e0397d716a1fd9d4e12bbeedb83973e

SHA512
b733976c03d65da67007a04a522fc2db065f1c34901a038c1ad46a828a200e7b452146889653bdac719d89c164ead4a1502009e72fee1a62a0e8d4358fef9dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ab592dde6ff023e_0

Filesize
272B

MD5
894e5785ae768df6f5ede8b9f47e23e8

SHA1
3ace8fc6995462f07f173c01cb6b8b6fd0d26b2b

SHA256
5e9a60129fef1c3582fc7d97bac45946640716a7a332791cd04f02f447e5c1b1

SHA512
fecd9b93eb63fd8b4dcb8dea2d4360f0ca9ff926d052ad7480821ce12c596e572288a9a62dae2fe797f4c89eb9cb86cdd470d1aa248efde86e89e78ae7598205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\67c896e8aae559d2_0

Filesize
291B

MD5
00c24d27268a7410b6e84ea5b4d62f9c

SHA1
1375ce97cd489dc5b73221e957fdc715a5e9a5f7

SHA256
a5a303a08427d0bb65c8ba59b2d3e54df0fdab7ec841956466d99cc6af6c3d70

SHA512
69ea3e3dc5736300a7271e5e43d57347d78ebb3adf0d13651a401538e183194c06f69aa7c4ab135495ede014b73ea4bd7dd2800a25dd2e92e42a766c32590caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ab6eb3f31f865a8f_0

Filesize
188KB

MD5
903df938b470b265afb42117a4486ce7

SHA1
2fc693cac27a403bd449db5ba91c1b45b476d1a3

SHA256
a7bc10dc1a508e2dd68769ef997ac5040c8d2089b7e229dd2a973bbd69780888

SHA512
a54e2486db11eaa506271daab111f1d51d71bc78d48c452a6d76adca3980c24de792d413900e8d040a1d938c70bd819c977cf60baa181d348d1f402b67679ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d331d6621a27c408_0

Filesize
1.2MB

MD5
95da38dd59ca20ba7f60fb6e72c5578d

SHA1
fd5d9f6fafab1a152cbee62a5229309e6163cacd

SHA256
2f7e228da7e4ec89e9d29f1281a207d9c378d2bb671c2378df7e464f9369af50

SHA512
da89af44a4a3cc9d1aba8407d621d3d9dab134a5f035b15771eb2541db60c2fac0b11776dd7cd11effb8536b15ce44daba9573a32b6c248b527de7f08f5072b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e91da4b52bb26ef3_0

Filesize
297B

MD5
00c15c072e5bbae1e12375e6b94cda15

SHA1
fd884321e2dfb8655830b1a3f16e530c4489cea7

SHA256
d8c017ac14ecf8ecba3dcfe494194a03ced8a6d84a21823b8ce94b879f9d9210

SHA512
ca499c151cc5335858a9e5989a542351266e0917cd1086bb50428e0ea88ab07e42398f65a99313db50bc184533a688067062ee45b57e880a80b708b99ab14677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f29ed5b5251e1eaf_0

Filesize
269B

MD5
b08a476a8777398e4a7fc2549f13a3a2

SHA1
887f38194209d8191004c143a6661d5c0bcc5090

SHA256
90349f4a4acac178241fcec5536f16821cb57096d271779cb8b783da01327162

SHA512
b3340dd1c91fd45b097480845b9ad09170a184860b49799833d06079d5344c0e93d42d6127917d0efc687841618e63416a94dc3ea2a336cdb4bcff44c64adea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8075dcb421ebba7e3d8089126813588

SHA1
0399df8bd133faaa2268825e039de92fe6c8b67f

SHA256
66ac84ac51361f773e8ab7cc89b781e95e409708343b9c1b1d490aa5209c652f

SHA512
b2939088110f21eec7657390196a5b9e512194ef8a37d787715af85b05d92fdce816b49aa86666989d654cb2832ee6039be61e12b5b417b6ecd58a1c85d1e267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63757f9a7bf029f45dbb2df2f14e15ce

SHA1
0f8e117efcc90232687c15e7612d3a95a83ee5d2

SHA256
4f82c4cb6e374af479752dc7a49162cea459c2e1deab831e7a239c7df95be442

SHA512
d07def1e8253351563d0eb14b43e789cba1869f3681312771252224d78a62bc19ef52955ee7e7d0b0a9df93de3d56b9ab8617ece4552c887083f93cb649350df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
941c40b3db770a52581993016bfdd734

SHA1
2b5f0c62cb48738e8d440102524e7734d198ad1f

SHA256
d1d7e10bf5a8d6c349098974bebaf8f62cf4413ea71ec17698c6582a10666ee8

SHA512
f21774c8a3b30be439728443cec65d3ba5f6b019dcfdc54dac43d7a9661bb019af5b6eb0f6ad28c273b2b57fdbf9c257347d17fa61a29e7ba240e88924bc1e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
458274b7a044f19f1114f4bdb8261bcc

SHA1
fe49bb09bcd2efb971674834dc84cd455dd0cfbf

SHA256
c78f74684da1f2d1c18ddbb5dafd151167156824d1b07d25b44ce21e7f31b796

SHA512
4cfcb862637a4abe16d2f429797af95c37286583c098ae4dc7368d83220fa12451d38c27064ca0244aa76633a99b6d9c283131b71036b6c222a3c81f6d1e9714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19d9c8fe3bab23a4f3e5694183c8fa4e

SHA1
5e700403a60818fd6465021158a25b61b8c2da58

SHA256
d3577b7baa4f0ebf1d663b542b11fc016418e91dc8e39e32df7bbae3edb8e653

SHA512
5bb9ea871be3312b66a4bf435bb0aeb8de827b3fd371e88de760a393ef6a5b59ba6d96877b45c79af7f6a33f0372128c0c9c316bf89264c0c98c9c9520d15eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf4152c955196a7a7ce1ea1b9aee1738

SHA1
a802d4b5bc9cc313c62ffb6916f45675093a2af2

SHA256
9a534bc31d64acd9f68e8960f050f3fc5c1ab29eb6bdef1ca605289e48fdd848

SHA512
5fa805dc3ce55c6fc116b112a8338eb2b4bfcbb43aaa9b1a677c57e3edb255ef6efdc0e06e9c11e24b277be900f9cb1b8792f73f9c8e2eb37fbb066a7511cce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3c38d03c595da75c4d685f82b545a43

SHA1
13192c073907a2b6f8f70fe57c1af061cd02a1ba

SHA256
a556dad07507da8716167eebd097d0961f9615e787809636debc84abcda46b54

SHA512
e2ad08e3842eb91f0d871b1d38183d357e22463cc473204be8ae4eb6ba060e6de845d4ca422d96632be930c7962116e3b9901a4623c44fe0cd402c8bef6df84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44550c74bd00419cd8671877d7d6474f

SHA1
457b530e7ddb3c1d7c08924b547c5b5d04ca5840

SHA256
62a1f1847d4c4631f373d593869b136940df358de0f17740d319b6ec55b2c042

SHA512
644a10b04d2491a8f433f7d91796716ee9338243cfa969c1c3fc2b06305be0db42ecb03315587d62549f3fd0c2f350c2168b027d3564a26ae79085965cb36cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8ee2b9ed61da25aaf118af8f36a8b881

SHA1
6946ddec43f938081fff9c461de67eda41136332

SHA256
8fab37c1f61a75b55a582e503ff73f5187c6f9b8f1cc0ca9c29b2b95b5518036

SHA512
c2365155487dae68b42242259a42997499afed3d44365d1121ac4e1e9ac69c5300b0ca4e080236e24382e325164dd62c0d692d596117ce5d521be35fa55fa2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
213cd7d6fecace961d7e7e34a2776f8e

SHA1
1453828da5dd1ed4c7dabaece9b6602f68e021ea

SHA256
3a50410e871dafb8c358f793fa3966fc4ad80afd5ed9390a5610076caf65c1d1

SHA512
49c7c5d85112b1162b4c3ee281dea05ae061ead7319d3b95aef4ca86b1b7ed54a1baf33e032f1e7964ea92883e1eca5c3df433c36c373df27c349a1f10f393c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b7efaf59ba0d4eb842e729e100fff5ee

SHA1
0302b8d50cc7495774a7e1145dd449f6f0ec51c7

SHA256
2a5bae8053e199f233fc53c7009641180e52bbc7072f4c6ad8604cd49543e8d2

SHA512
fd8c96c1f36c5ac7c0c65d24ec624590552f811b9cf0c756986f843e5f2e31628b0424d48d7c101617788cd48c0d215bcd2cf92315361708bcdd9ed6150902b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4126bce21d6a7576ba1ab4f60b6285f0

SHA1
064936360e3ca751cc70050db2f2a12046c70592

SHA256
63b0fc63451fb35228bfa846ca9ec471f7aed6e02c6fc9b75399ad70b3dbea80

SHA512
a362a6a3ead822b16e9eb5adfa609f595bfcfc38c92171af73863b3f05e50c0f43bfd100276baa5c4dad2ddf893e4eccce1053a070cc070a99387cc2b7e83695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
43c93ce482077a636aff7fb607d0c8a0

SHA1
2d1c20bb01472c078a01001e2f01a2809f15930b

SHA256
233d19c56c12bf956b14e49b96c9ee300363607a24d324030875337f49846467

SHA512
42b879f0f9a6cafe910a45a00d440e08bc761d17d7f24a1210f42623f82ac6f9771bd43fa11dd3fdf8ae5ef74e4f1bd46036b36e52e0a7585f7ffda4d80e288e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
066a97af6f12651836f6a031a1bb2475

SHA1
9ffa9f872673bfaaa0cc1dce484c0019f3c23c56

SHA256
beebff0897b44dd21865bae86dd47ee1b7b3b2936c9f6110dad1cfdb57e05e77

SHA512
422a8ab8bf6155a6db61b2530d4198708a669ad7ef0b1075263135cc3c7897dba58621d759e755db51e3d3ef62394ed0a276a4ec9e76b8413383b85cbc1af4de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
32b61b176e563e16d3c51a4c3ee8bb1b

SHA1
7a0a7a3a5fe13993b5dc045b1fc4ff8e2a711cdc

SHA256
08773243144916cc22e784387ccc82e73ac6093b30c66531d4b3bee0fb532932

SHA512
ca89eca54ccea1277e3ac0ea5f24ecf7353dc34b7e108cc2b1d0963216ed695e16e3b440d03fe75369a219077c08ed1d26903f2418fefb7006dd349f9b58bacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588681.TMP

Filesize
371B

MD5
57fc4ae42feafeacaeebbada2c122af6

SHA1
4122d347ac672890354fde2586d98cc1fccfc235

SHA256
910d464ac329b6c3b2326a1e12ca80b1a6207ed10b81d386c559c760007a859b

SHA512
1fd971f984cbd611f08c081eb4b0edad8b0a0b78eaa87c3e8b16896e0930d1725f89479b34017ec21943bdbd4a8929c775096f962636f67b43409501222c2ae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0ac1872-99c2-42fc-af6a-4791ab2448f6.tmp

Filesize
6KB

MD5
144de1040ff6cd16c70d2d3ff43a49e4

SHA1
a35e89a9167674441ec1df82c6119d932e63995e

SHA256
3bcee50d0e999c8c35234d895ddfb3f90652a97cdf1a7c18949a4f9c07d521d4

SHA512
9789725d5a6b522d2b3a6329e16b4957a4237f80768ae7a9be83a9d779af53adbb7993573d81b150eb9a3d9caf9298a089498281203e681dc590fbc4e8d7ebc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
227b3b10d03cc3ecf2b3448b89607d66

SHA1
a41e2c15a56554ef092277de68d323bed5a8e6c0

SHA256
70cc0e030011473977a3945a22a5780e12d041c8cc50cb030b6216a737aa2b49

SHA512
1cdf15e624dce6d7992c8d20703d3d7ad5d6fa2049fda89643756f542ca0c5592e51ffaa164f9edd14fee6b47eed27c80d628d76ed01a7549a2a7e22e053301e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
534621da79bd8ad2dcd82603ec687720

SHA1
21ec39bc8477eea06627ea78f08266fe69355970

SHA256
1cdff97b4235b27a919df3255ffe38fbc5d9fed8d9341c59e27669285f81d585

SHA512
cd082695a9cd20441316fb9929a1e3614941badc3e11c5fd279415faa88bc2248188b7f2727a30701231536517d099e1413bead48ef5af534abadd92138403e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dba9cdbf-0622-43e1-801c-8b52c3691e53.tmp

Filesize
10KB

MD5
548226605d93371e8b07a9a147c79af0

SHA1
7a08f436373cbb9b5f854d7536828d9e5a4bb7fe

SHA256
21343fc3e9c99246ecf851d5a5b0569693f47b2fcb466e7ffe4dd5330591c62d

SHA512
a41935522c818452d8d1293be09008f33a5f0ed69f559b0548e87e71e0d00a6e6051d5fe8870e65031a34e6660c8c39b89d01d8b63e6b8a8a4b66be667a363a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
66272a555ddb3fd9e9266c243902ceed

SHA1
bbafdc5138ed1f0faae0b3c056107d8b356fe32e

SHA256
7697a1cc0625c095a71fcd1b7b88a00a9f71c074796ca74734c7557ac130a38e

SHA512
37097a2166a153d992e7b9b6f204766655a0e4ce6f892c126161443fe9c02cde4f24b57247a46ea935221e7f622097f361c4331976a56c20eb3d827d76e57d27

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwic4ah0.bxr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Graias\graias.exe

Filesize
960KB

MD5
7caf240db905f259197cf71b03acf888

SHA1
d8d9726a0a67795a01fed368055d9315feada3fd

SHA256
c8017f526793dd8b6b6e98bfa9847fcf3aa7c4096a8432719a8324e06ba8c088

SHA512
1f9464e14d33bfab44dfc85486bea31126a26929e04eae1159e6ecc886aa79877ca29aa93e614512625000d153e090c06b3b2081f9cbc1e8997ad26e59097255

Download Submit
memory/1380-790-0x0000000000AC0000-0x0000000000BB6000-memory.dmp

Filesize
984KB

Download
memory/1416-20-0x0000000002E90000-0x0000000002EC6000-memory.dmp

Filesize
216KB

Download
memory/1416-122-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/1416-119-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

Filesize
32KB

Download
memory/1416-118-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

Filesize
104KB

Download
memory/1416-117-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

Filesize
80KB

Download
memory/1416-116-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

Filesize
56KB

Download
memory/1416-115-0x0000000007C90000-0x0000000007CA1000-memory.dmp

Filesize
68KB

Download
memory/1416-114-0x0000000007D10000-0x0000000007DA6000-memory.dmp

Filesize
600KB

Download
memory/1416-113-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Filesize
40KB

Download
memory/1416-112-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Filesize
104KB

Download
memory/1416-111-0x00000000080E0000-0x000000000875A000-memory.dmp

Filesize
6.5MB

Download
memory/1416-110-0x0000000007970000-0x0000000007A13000-memory.dmp

Filesize
652KB

Download
memory/1416-109-0x0000000006D50000-0x0000000006D6E000-memory.dmp

Filesize
120KB

Download
memory/1416-99-0x0000000071C80000-0x0000000071CCC000-memory.dmp

Filesize
304KB

Download
memory/1416-98-0x0000000007730000-0x0000000007762000-memory.dmp

Filesize
200KB

Download
memory/1416-95-0x0000000006CC0000-0x0000000006D0C000-memory.dmp

Filesize
304KB

Download
memory/1416-92-0x0000000006760000-0x000000000677E000-memory.dmp

Filesize
120KB

Download
memory/1416-84-0x0000000006290000-0x00000000065E4000-memory.dmp

Filesize
3.3MB

Download
memory/1416-76-0x0000000006120000-0x0000000006186000-memory.dmp

Filesize
408KB

Download
memory/1416-73-0x00000000060B0000-0x0000000006116000-memory.dmp

Filesize
408KB

Download
memory/1416-72-0x0000000005890000-0x00000000058B2000-memory.dmp

Filesize
136KB

Download
memory/1416-53-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/1416-23-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/1416-21-0x0000000005910000-0x0000000005F38000-memory.dmp

Filesize
6.2MB

Download
memory/1416-19-0x0000000074AEE000-0x0000000074AEF000-memory.dmp

Filesize
4KB

Download
memory/1516-436-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-666-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-280-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-808-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-789-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-667-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-281-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-533-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-532-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-125-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-132-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-437-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-126-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1516-129-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1592-343-0x00000000006E0000-0x00000000007D6000-memory.dmp

Filesize
984KB

Download
memory/1640-133-0x00000000006F0000-0x00000000007E6000-memory.dmp

Filesize
984KB

Download
memory/3120-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3120-11-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3120-97-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3120-15-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3120-12-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3876-146-0x0000000006660000-0x00000000066AC000-memory.dmp

Filesize
304KB

Download
memory/3876-159-0x0000000007BA0000-0x0000000007BB4000-memory.dmp

Filesize
80KB

Download
memory/3876-158-0x0000000007B60000-0x0000000007B71000-memory.dmp

Filesize
68KB

Download
memory/3876-147-0x00000000749E0000-0x0000000074A2C000-memory.dmp

Filesize
304KB

Download
memory/3876-157-0x0000000007550000-0x00000000075F3000-memory.dmp

Filesize
652KB

Download
memory/3876-135-0x0000000005F30000-0x0000000006284000-memory.dmp

Filesize
3.3MB

Download
memory/4144-242-0x00000000006B0000-0x00000000007A6000-memory.dmp

Filesize
984KB

Download
memory/4884-9-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4884-5-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download
memory/4884-7-0x0000000006970000-0x0000000006988000-memory.dmp

Filesize
96KB

Download
memory/4884-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/4884-10-0x0000000006B80000-0x0000000006C42000-memory.dmp

Filesize
776KB

Download
memory/4884-1-0x0000000000BC0000-0x0000000000CB6000-memory.dmp

Filesize
984KB

Download
memory/4884-6-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4884-8-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/4884-4-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/4884-3-0x00000000056C0000-0x0000000005752000-memory.dmp

Filesize
584KB

Download
memory/4884-2-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/4884-16-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/5872-668-0x0000000000C00000-0x0000000000CF6000-memory.dmp

Filesize
984KB

Download
memory/5888-567-0x0000000000E10000-0x0000000000F06000-memory.dmp

Filesize
984KB

Download