asyncrat | hxxps://limewire[.]com/d/f26cb7c9-0054-4b4b-9587-e50625350292#YKH7Qj-FbhOdfJzxI1Z4-6xyA1OZ0-ur0nh9CEDE4yE

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2025, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://limewire.com/d/f26cb7c9-0054-4b4b-9587-e50625350292#YKH7Qj-FbhOdfJzxI1Z4-6xyA1OZ0-ur0nh9CEDE4yE

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

js17j8iCA1rZ

Attributes

delay
3
install
false
install_file
GiggitySigma.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0004000000023273-439.dat	family_asyncrat

Executes dropped EXE 11 IoCs

pid	Process
5976	asdasdasduh.exe
3188	asdasdasduh.exe
6032	asdasdasduh.exe
5012	asdasdasduh.exe
5208	asdasdasduh.exe
6068	asdasdasduh.exe
5048	asdasdasduh.exe
5204	asdasdasduh.exe
6012	asdasdasduh.exe
5124	asdasdasduh.exe
1892	asdasdasduh.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdasdasduh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 603572.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
3500	msedge.exe
3500	msedge.exe
3108	chrome.exe
3108	chrome.exe
5744	identity_helper.exe
5744	identity_helper.exe
6096	msedge.exe
6096	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe
Token: SeShutdownPrivilege	3108	chrome.exe
Token: SeCreatePagefilePrivilege	3108	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3108	chrome.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe
2176	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4972	3500	msedge.exe	84
PID 3500 wrote to memory of 4972	3500	msedge.exe	84
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 3620	3500	msedge.exe	85
PID 3500 wrote to memory of 1148	3500	msedge.exe	86
PID 3500 wrote to memory of 1148	3500	msedge.exe	86
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87
PID 3500 wrote to memory of 2776	3500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://limewire.com/d/f26cb7c9-0054-4b4b-9587-e50625350292#YKH7Qj-FbhOdfJzxI1Z4-6xyA1OZ0-ur0nh9CEDE4yE
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce88c46f8,0x7ffce88c4708,0x7ffce88c4718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6096
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3188
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6032
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Users\Admin\Downloads\asdasdasduh.exe
  "C:\Users\Admin\Downloads\asdasdasduh.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13743444022788950299,2507289506971333473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd7f5cc40,0x7ffcd7f5cc4c,0x7ffcd7f5cc58
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=212,i,8586023905655822027,5271030426506130590,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Users\Admin\Downloads\asdasdasduh.exe
"C:\Users\Admin\Downloads\asdasdasduh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048

C:\Users\Admin\Downloads\asdasdasduh.exe
"C:\Users\Admin\Downloads\asdasdasduh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5204

C:\Users\Admin\Downloads\asdasdasduh.exe
"C:\Users\Admin\Downloads\asdasdasduh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6012

C:\Users\Admin\Downloads\asdasdasduh.exe
"C:\Users\Admin\Downloads\asdasdasduh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5124

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2176

C:\Users\Admin\Downloads\asdasdasduh.exe
"C:\Users\Admin\Downloads\asdasdasduh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
dbf410e07ec04949be001bb1a342614e

SHA1
aa3b434bbc60837fd2c26d57b2ec051d78bd029a

SHA256
9978ccea666a820af63e7f8ebf58cc6d671a0538b2498913ae9c6fd659121055

SHA512
9fcceb5f45ca16e17c4aef79dee5d8b32b29dffcc1254a230d41de132650154c95edba02bb1c3f9736bfda90a9f352db67ddf3a11ef562ce7044ea9eaf0adb7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
364d89dc521faccacb0370bfdadce8ce

SHA1
5543e7f174722bf12f83d91a53edabc9a98bd43d

SHA256
6d3d66622d4bd476d8eba121175a19a621402bee9513b53442b4ce82e1f498e3

SHA512
3b5e65ab982cb8e22dca04be6843a406784aecc91280cfdcf9c485d29c819654b9bf50597d6a9845a4e7546f39949f2b9ae6254d76928c7a88d8ce31ad51e4d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
710ea1222325475680dee46a0ac0c1e9

SHA1
bafe8a0ea21f7ca7e41b8ba37497ff50bd72393e

SHA256
bc93e31bdeaf7802a2c5653b0f2dee63925352230241fd3157b31c8dffcd98c5

SHA512
dc6b7022f581c681ab1081ba9235b4566992e7eebbd83cbd873e18ebf10c2886d27d650383513f35e631e691b3ff09cafcc3bda0458b58e61793e488b4ca7930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a8bc142bbd950d8cf8847c6c21fc85bf

SHA1
65edd34051e167091e0c76f91860ea8bfbae9aa4

SHA256
c370c0879065b7c957b8d416d79846ccc0eec7db3daab91e5072bf59f92fb14e

SHA512
ebf7e264444de796b3186e41c037d227235e1a80a533db7d51c05ef9ffc2f588bae087baf83772bcc9a09a76fd0b40f6f08cac8d76b77f7b61ebad6d87644eb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a750e4d2837b4c222ce4575acfd38d61

SHA1
c335d115e158de39ff24f3de1a5aa5338dc8089f

SHA256
ce2d49d003c39bece2cda91d23a9d14c81e15a359b3397ffb67946acbc8410c5

SHA512
52d54eec08b585151c9e40b8f95aa520eca0f5e6843caddb8c0f986c095cbd7bff87d42cfd46569f8c079ec8e8ae142d623deba3942ab3dc7962ddd66f65bede

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4e0e5cded14fff2ee8c6d458adce9b8a

SHA1
4b339ba4479203470c69bad27003e8ac6277c778

SHA256
9d4524572e8eeb34655c541ab76491e1e48f63e05f0784f11dafc3aa1df9eb25

SHA512
cd5240fb0eba4a540b1a47c7f0386784eab636a901e326cfdfbf631bdd7ae4110e52bfc6240cdd2b4ea4fb0a7005806ebed8eaf49196bcf242d60714a6830c83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dda160107f8cf9d6cdc441e0b54d254d

SHA1
a8ec2045159f3dac57add5fdfebae9e4f0b42a61

SHA256
3841cd6c903c34527c1419bf155f15f930600325c5d13bbffa5faf66a5cd050a

SHA512
8862d5158304a8040916518427e5fe2af4ed86bc24421b80e64d99d04c9d485529cbdea42d836e83398281e6033d8656dfd053e604b56072cfbc8253193a6b94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e87210033045ce4dd3e43963628eb9a7

SHA1
c4a74227ac9e5efe202ba601509a4eb425f6da6a

SHA256
9c395d7791b052fe7c10171e04b7ff6a4bcec752d8a9b1a95e513eb276be5d2d

SHA512
0811d9b817188dd2b1f3299aa67d24d2cc31d924053e8139651692f2378df4d3db6fbe1430ecf9e020a632da8ae56cadad61c72df4dfef503678f8c1590e2fc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b1371037d863f591ca2a5d66f86b5426

SHA1
69904454b751c3c60bb83f44248b50367980a941

SHA256
007267f8ae1784e588e38d9ea2c21a17aa4939c62b09912712a4c86a923da317

SHA512
4615fdb9a5ef0ad49f3b63fe974a5d73d9aefc9765d40abd25bfdc364e667d0416a58c4c0ddc7f9f63c535b76242a3efcda87c26e5cff6f0d85643f7ec392644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b0e7aa2eacc482f2129df41c76a2d8ea

SHA1
4db6def6223b114f02014b868a7b6918d56d5cae

SHA256
43ac6dccf33e44dfec58b155f6513670e1f861aa901f72719c9eafc3e7efc2da

SHA512
d9669a0436cc6d0be1479e9299543467e54007f9608262f78fe4899f34959743e38b7b09f312882c3575252610bf8bfefd984610c87d2ce5860be6f86dc3c394

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d66dc5b843d0c340d04726fe02ce6b9f

SHA1
bdd690d6f6191cbb3f43bee0cf2e42a182373acd

SHA256
6a5fa70cad367dca05b74cddd589845d0c4fb8e281353f0d0a6da8a8b0583695

SHA512
98ef23c325a9642e1457bff3231daefa11a771f8be7b2bf26dfbdc3b3d6a8b9de6e4eaf97892b5b9026f5819421dd6b7e59f917aa8ba84458246cc66a4836a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
6168b7f8cba999e9e001303a26a75973

SHA1
9829821739f51d4b36aee718826ea0d9b97bc885

SHA256
19e6dc455b12c2ebd331fb8032c81b936cb194a182dd8ae34882b0f9fb1c23e0

SHA512
42de2947328d7ad526b09db262f0eebd58b92516c16ae131bba04b10a6e25b81779d2268a15f6da9ff4c1836e59d21f884fb47e003353de03f0b057c60ffc363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
b0dd464935d45d8662b709ccc217aa2b

SHA1
78cf18b707ed46b8c80522c8be7ecd45ddb7316b

SHA256
15b3d86e2a1740716ae84884f6e33470072abbb7c05be701011e4a2ba00a1e50

SHA512
84fd09105f09aabc2e85a4edf44c73084dac410162abb2b31ae26aed07eaa3b4065c4f278ae0037c7b39abafc08542c31ce703dac740bb55d9376bb10f2d9b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\asdasdasduh.exe.log

Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
70bd9f826e8e35b9edb35941626b30c8

SHA1
b35ec3fa395573ce326f63313cc6f4479afe3296

SHA256
696aad572ddc4a9cfb2880734defb1e88d5a3a47988466c93f975e0d7d16628c

SHA512
c9d05c66c5d2acf37249e73637c9f4d09f912351a21863544e9025b461f62391ea166691d546fa58bc86248b7cb767eecfefd5ac2cc0ef12322629d9b8728141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a8d38add2c49853e1d0b4e7b5664275a

SHA1
c55dc2cd69489e1855e3ffa73c6de0a650aaf340

SHA256
3abcec37584f57bfbc6832b2cd9cf9699dd0c86a00d9fbd06e78c424e9e13734

SHA512
4651401240e9f8ddb52315dc0cf02eb5531907254814d98b33f83ed6807c3b9e75042f5c340d59cb7d4a507e861f6ed25da26432f9c10a9923eaf3f4c9c437dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c5486f789207bd40abaec04c49ba27

SHA1
3286788f88bfe70f144654f1815e86405f94acdf

SHA256
5a03d834c6811a37087078222dffd2dca31d1af39d39e423993a77aa29bf3858

SHA512
c0184b60940c573458397e06307af8fe710d769e6235ff83adfcf19c3a8e9600815782bbbda5ef5e9caf9b09cb46985fa1cb70780e682a8f58f44763ce394594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5894d046ad9693feaebc8ec4375323df

SHA1
fc72a33402137291aadf330353b587c4a55de231

SHA256
bd3808e90e1adb143e1d304c6b39757cee77c890c0bf2cc3d6a320d00a6543fb

SHA512
ba42a90b3d4d8f35544b14cb989b1cc0407b579b8dcca4d1551d27983fe597dc803e7d512b2be329c9ed63deffdb89414ccc8d067fbf7fa967d3ba6b31a4cd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bff348cdbeb6cb7ebb3949e88613b318

SHA1
61a1fcfecfde837c3b264e33eac25d372f226eee

SHA256
c0ff0b459d24fc539ce6caf29b8e809add94048ff649a73b96f2adf6d5a7a0dc

SHA512
a1ae5e3ce4a7f6a94f52b9d94b1355eff5bae4547a8db5f5d7b2fe6f58acf47f2e2adf348c6455118e6a5eb6197022d6a8abfb44f3915059cf81da1b8b3b68b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\1f6d5bc1-e1d5-4c36-b31e-004d3194946b\index-dir\the-real-index

Filesize
48B

MD5
3a15ed31564e2977788d211b5905cbb1

SHA1
0ea6ead6e0ae499b7f1e6c3c41b55ee83bd8618e

SHA256
9d771f7ec3d7fecdb4af29fe3b93bbd175d54c95215dfd6489741049c169c924

SHA512
42228a441fe4dbf45c6fe3c943bb342631ea69d073cc2fc455d588c2d19908b9a07b01cc5670dfd206364639d9d271dfe8c4376a7aca1e4b9e1cd970ec3ee5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\1f6d5bc1-e1d5-4c36-b31e-004d3194946b\index-dir\the-real-index~RFe57eaec.TMP

Filesize
48B

MD5
008f3246409735b7fa18417236d20158

SHA1
25c5ff8812706d200700c92fedf487a83652fbfe

SHA256
c317ba6e392e38efce4c9734ad133cce7a1f0530de01d7bef334e6a20872657b

SHA512
0cbada0c59cb1a5749dfcfd4238db7be20b5e5c9e382268aab558428f23f085dfff5abfd288a5a4989b87f22a6dd108c72f1eda9f44463819ab57f4ecefe4462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\index.txt

Filesize
84B

MD5
8fcabe74fc3f1983c593f84fd995aa50

SHA1
ef0af6a9d2047819628e13f045dbd585a3b84d6d

SHA256
4e28bb37a2d033bd5b431bed560a42186a322c1a59837de9efe4ea20c529356a

SHA512
b3ff1cfbe14fda8e63ab1ada8e09093fb516d74e775718ff109846614c08e50a54a0e1a37321d66453d44c216e74d592f760cef00fcc391104b30a7c5e721cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\db4125b5f40e60705005afe796cc0071c6f09794\index.txt~RFe57eb2b.TMP

Filesize
91B

MD5
c78156e601068e6bd37b53907ea326b9

SHA1
40af7ce27ed30c2435e6005f9774d7aefa82b1c3

SHA256
3406a25f743aa679a1259e755be1f634db4f224de548736242b2390ed832acf7

SHA512
0ad4db44b181da74362292a22165b2eb1d46e6f1d3b82d48a4728351937b9c67341f98a7410e99142fe6ff00de54baad039c90b9d52f2f361063ff429e880b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f93c1b4bd14812a5c5e138a6a0a0369a

SHA1
8308555317adc487bc34bd3ef0d8ca571506f3fe

SHA256
8d502450b63ebd67d01d5102e350d630469f90a2c066870171e75b023c474c0b

SHA512
1a45d39ecfb45f9e8ce9e5eb34f05f67e2450a393e39474f2f657b8b97712d0327f3aaedd301a7468d079ce616fae9a61412682449657fc898437497f3fa667c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57eadd.TMP

Filesize
48B

MD5
26254d040ac8c04ed26a949712d9ea6b

SHA1
ee40223354863079642ef7c2c95173760b7136c8

SHA256
aa97c807107ee0c8c93e504bee5660eb3f4f53d4dd9dba067ecb80f9adf5bc55

SHA512
7affcbd9ce83eb99a7cb604a16bded673a8763144f4e97a866af9c89a8493c871b4b413ce9d0dc1266cbb96204eae7ffc5aeacf79ceaa402c016bec7f696eb33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fff029a5fab016c93bab85d0f111dd5e

SHA1
412c6f0051b391cbf48ce4bc7238c6eec6b2e141

SHA256
3ae1f1f98b5ab1c2b8be2f381af098f1e244d996c9fe246810f9921bc107295f

SHA512
9dc134f401461f37ac7231faec1c9ea35afbdf0229216610ab8db9d84ec61fa702e86670e5add579797b275263c92a372e4bdb5051a09f10d08c2c879066de59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c97a.TMP

Filesize
1KB

MD5
432edd67613e1981a2669a638d0814dc

SHA1
0332475bb8223b68911ef18d2e09fa6107483f27

SHA256
417ad6b2abdcc985a968176164f4bab9bbe23d02ffc894b81208ecf9cb96b189

SHA512
edc67f62ac7873f526d1f48d90330576408d0fd6d4ec12eb72b88038a87f48cccd9ee40c8caff8d6a1640b4686627a85afd64a3625b0c7b5201c09233d3fb809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68951b39d806c89ad88320d9d6b7bc2b

SHA1
862ef09498d823dac5d475b98ba219812160f25a

SHA256
b6c8c15ef429c3774162853e8b2ee943e7a3fa701d3ebbc15e9ca5fef3dfe989

SHA512
348ef0b0fe38b6b910eba5b071a422d988ac12a9aa02c2d794aea9c85bbad87cbdc83d64542e834264c71c472d12235467305075e83bdee5f31e184a29b54a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c4a062c41b5af3a5488bbb01693ddcf9

SHA1
bec7251c3783acf997545f9a02b9a4960281b9ee

SHA256
373451a7eff635bb004749140e3e62e790fc1eddbe82e505c51122199d08b27e

SHA512
56e8d89a493ca4acce2bd26887a9ca3da149c67b300cbe4ad873592bbb2acd097700ad5b03ee8c77e960e86483b2b9c237dc5f0b190c59537ce39b834b8c93d9

Download Submit
C:\Users\Admin\Downloads\asdasdasduh.exe

Filesize
45KB

MD5
1650cc9f77ab46680b3e227fd0529146

SHA1
174c865ca8b39ef30ac8d8a89ab316bff6878aa5

SHA256
364759456b46e107b4df400464486b4de2aa05a58340c4e7af4fea7cc0d67486

SHA512
1d2af54727a01ef06b861043e1de2c9ef06502b3326028c5dd0582045a82245f9f0c83c7413c5ed69458f5b14204f39292eaf340961b6fbd87260a803521d391

Download Submit
memory/2176-669-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-668-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-667-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-673-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-679-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-678-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-677-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-675-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-676-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/2176-674-0x0000028CB9EB0000-0x0000028CB9EB1000-memory.dmp

Filesize
4KB

Download
memory/5976-453-0x00000000006D0000-0x00000000006E2000-memory.dmp

Filesize
72KB

Download