crimsonrat | hxxp://example[.]com

Analysis

max time kernel
166s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://example.com

Score

10^/10

crimsonrat discovery evasion persistence ransomware rat

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023dd7-530.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Executes dropped EXE 11 IoCs

pid	Process
2552	CrimsonRAT.exe
900	dlrarhsiva.exe
3604	CrimsonRAT.exe
2000	dlrarhsiva.exe
4784	CrimsonRAT.exe
5036	dlrarhsiva.exe
1552	CrimsonRAT.exe
1524	dlrarhsiva.exe
4868	CrimsonRAT.exe
4048	dlrarhsiva.exe
2228	000.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\P:	000.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
197	raw.githubusercontent.com
198	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop\Wallpaper	000.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4880	taskkill.exe
1532	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3442511616-637977696-3186306149-1000\{912A3E67-63D0-4CA9-8D6B-90490B24DAF2}	000.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 581291.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 794185.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 530012.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4852	msedge.exe
4852	msedge.exe
1448	identity_helper.exe
1448	identity_helper.exe
364	msedge.exe
364	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeShutdownPrivilege	2228	000.exe
Token: SeCreatePagefilePrivilege	2228	000.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4388	WMIC.exe
Token: SeSecurityPrivilege	4388	WMIC.exe
Token: SeTakeOwnershipPrivilege	4388	WMIC.exe
Token: SeLoadDriverPrivilege	4388	WMIC.exe
Token: SeSystemProfilePrivilege	4388	WMIC.exe
Token: SeSystemtimePrivilege	4388	WMIC.exe
Token: SeProfSingleProcessPrivilege	4388	WMIC.exe
Token: SeIncBasePriorityPrivilege	4388	WMIC.exe
Token: SeCreatePagefilePrivilege	4388	WMIC.exe
Token: SeBackupPrivilege	4388	WMIC.exe
Token: SeRestorePrivilege	4388	WMIC.exe
Token: SeShutdownPrivilege	4388	WMIC.exe
Token: SeDebugPrivilege	4388	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4388	WMIC.exe
Token: SeRemoteShutdownPrivilege	4388	WMIC.exe
Token: SeUndockPrivilege	4388	WMIC.exe
Token: SeManageVolumePrivilege	4388	WMIC.exe
Token: 33	4388	WMIC.exe
Token: 34	4388	WMIC.exe
Token: 35	4388	WMIC.exe
Token: 36	4388	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4388	WMIC.exe
Token: SeSecurityPrivilege	4388	WMIC.exe
Token: SeTakeOwnershipPrivilege	4388	WMIC.exe
Token: SeLoadDriverPrivilege	4388	WMIC.exe
Token: SeSystemProfilePrivilege	4388	WMIC.exe
Token: SeSystemtimePrivilege	4388	WMIC.exe
Token: SeProfSingleProcessPrivilege	4388	WMIC.exe
Token: SeIncBasePriorityPrivilege	4388	WMIC.exe
Token: SeCreatePagefilePrivilege	4388	WMIC.exe
Token: SeBackupPrivilege	4388	WMIC.exe
Token: SeRestorePrivilege	4388	WMIC.exe
Token: SeShutdownPrivilege	4388	WMIC.exe
Token: SeDebugPrivilege	4388	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4388	WMIC.exe
Token: SeRemoteShutdownPrivilege	4388	WMIC.exe
Token: SeUndockPrivilege	4388	WMIC.exe
Token: SeManageVolumePrivilege	4388	WMIC.exe
Token: 33	4388	WMIC.exe
Token: 34	4388	WMIC.exe
Token: 35	4388	WMIC.exe
Token: 36	4388	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3572	WMIC.exe
Token: SeSecurityPrivilege	3572	WMIC.exe
Token: SeTakeOwnershipPrivilege	3572	WMIC.exe
Token: SeLoadDriverPrivilege	3572	WMIC.exe
Token: SeSystemProfilePrivilege	3572	WMIC.exe
Token: SeSystemtimePrivilege	3572	WMIC.exe
Token: SeProfSingleProcessPrivilege	3572	WMIC.exe
Token: SeIncBasePriorityPrivilege	3572	WMIC.exe
Token: SeCreatePagefilePrivilege	3572	WMIC.exe
Token: SeBackupPrivilege	3572	WMIC.exe
Token: SeRestorePrivilege	3572	WMIC.exe
Token: SeShutdownPrivilege	3572	WMIC.exe
Token: SeDebugPrivilege	3572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3572	WMIC.exe
Token: SeRemoteShutdownPrivilege	3572	WMIC.exe
Token: SeUndockPrivilege	3572	WMIC.exe
Token: SeManageVolumePrivilege	3572	WMIC.exe
Token: 33	3572	WMIC.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2228	000.exe
2228	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2300	4852	msedge.exe	82
PID 4852 wrote to memory of 2300	4852	msedge.exe	82
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 2556	4852	msedge.exe	83
PID 4852 wrote to memory of 4276	4852	msedge.exe	84
PID 4852 wrote to memory of 4276	4852	msedge.exe	84
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85
PID 4852 wrote to memory of 2244	4852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://example.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2552
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:900
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3604
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2000
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4784
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1532
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4388
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3572
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /f /r /t 0
      4⤵
      PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,5162599784683582330,3915448476504828899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4200

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1552
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:1524

C:\Users\Admin\Downloads\CrimsonRAT.exe
"C:\Users\Admin\Downloads\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4868
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:4048

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3948055 /state1:0x41c64e6d
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67a97adb-709e-4d66-9d50-46dd9fb90894.tmp

Filesize
1KB

MD5
340d87540b704d3de90a21e9fde2e2dc

SHA1
262032e3d0fa1a3207d0601ffc5f86a65613151e

SHA256
f212d35589c77ad4414592eb74363be89bb2641d2a2392318af573a38000702c

SHA512
e8d9c9ffb8138c6b4908fc5cd7d585ed952468ef1c3630c955ab9154c463a0b33aeef4988c83fffdf19bfed68bd32f0c5ba68f095fe8b6890b5ccd97d0344b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
cb8c89efd62ef9603076b37b9e77e299

SHA1
fe9700f73f27eaecc7ec87a6e1564d26abf147bc

SHA256
df8ca1f564820325555f29c4316b15abeafeceb347993037113690f3e0ededf3

SHA512
a438611efdff6eedf586a96af62a90e574e49948af4ff9bd037d2fc71333be2d682d5d4b380a6c3cfa6aec5d1471dd99c9fe6ad94dfe0ccf8cadd83bc18d7ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8b3eb7a92efbeef67cd53af2ace17c09

SHA1
01f06944b89e69a109e3b9e9e451f3b033f6e484

SHA256
375cae43c53d3e68c61174cfd6cc2450abd8bb68d2d24fb2c8b6f32fc1ea652e

SHA512
c25180afb5a7d3903855df8877f85b7897efbd9c3dc31a7485791318f2aea72cf595684ce41cf5dcf2d05214fae768a06a2957386acbe63aa9b9e3397a343a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
49c797e545291c4dae5ebe1dd86b6065

SHA1
f20d91678507ba652d485d40ac755d57d58c7d33

SHA256
2b9ac6d17a346b3f2c15c59eafd717c74fd4a4a20b87fc9a2c1bacd696cf2510

SHA512
cce3e13f7894fd83cef5f090666f1013fc1550066198f5b572dd4c8a57f104009d39ac76653e3699166bdc9208f21d3405494948d3759f1e84c23463c22aa68b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4e11ed75a70130c92b1da45cec3eb7e4

SHA1
acfe42d46932721c4a43efedd7e2802d523f12a2

SHA256
03b696553dd59d594c8dea4c284de1c9faea0abb1306aaa667e9b56c2e215164

SHA512
03e9341727970e3b77458c7d5af4005fdf77df2f8f0bac7da5b8d4ed0fda266ddd2fa8a666ee0daf7dcd8536b285c27f7eac458318cd4eed2e82a696599bc5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc52ebbd7a038998a8f2c7f3095784a2

SHA1
ee0cf674856af76886ec0b3fa52ba46d5e28c056

SHA256
4b49c5587dca926e75c0e6d900a0920141569368e964269b8af9372055eeeae1

SHA512
c00518397ea7eeac4b99f59f77b830bab83ae1b15853176e5f80a456a0e195be9dde1813262b50d05ba6124fa2573738beba0ea5bad874bb4eacd7954e6d1aeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cee8fc04fa96063aa94f3e3919a6ce47

SHA1
70b69a27e59612c4d9e76e396b3935d26601e9e6

SHA256
f0fbf3d2e5c6dbcea742a88a2723af5ee7bdf76d01a4d0ff7c897f13c26b1595

SHA512
58fa40921ced35f127d22bd2c0e11e789835ef82cbf898b986e63605653c337ad45a1b95120662f1a9098e24897bac2e9136586f504d4d67e8d70bef8b3a0f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b61fbfcff398abcbfa84b05001f9f23a

SHA1
e65f77aca699cf14c2358671dfccaaf1766bfeff

SHA256
ef579834fe0b9d4a724c4900eac28f03476429123c8d4b82dc9c65e0a0521fa1

SHA512
b649302a17143e1aaa8249fbeba511d70dda3c4c7b5ac537d3151f12b31a24ae676a65d2dc5f90052d47c7a8f6f54006350884d558580d9ffe7b7f0d2e3d67e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c9292300b454a543a22f3566597d8b1a

SHA1
55bf7ccb887ee40ab1506be6ee71164b5f439a09

SHA256
d7ac58137c14509c3deb63096e232a0cb0ba47b834a4ce33f6721bea97c93b3a

SHA512
25eab36f38db3b3fc9b92c5cca3e8b4f67ce0744cad1d577f264e7e3fac1b7c0cf783dba0ca83d4a3802192ed31fe241b20de4c81149ca9bb6483a14e9d07d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ec082c6c6f63d5b2b1d1daa83f088fb

SHA1
52d6052066a5c8aa99a9dcbea254b616684d8841

SHA256
0958622d51e7ded25add5e99945b6799f27d26f803992ab36a943d78ec0cb7c0

SHA512
da512a6c786fd83628f8573897691e88077cd5d11a8e95ec2d09a7d63e53f8989a8b85e8f619892d6f2b25db6642a15c5fb2c251df424a62e60cff86870d0789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
325c9d5014e20d38e59085c2300ff814

SHA1
d05bdc60f55fd70f13ab6c6edcf37b061d1576fa

SHA256
adfbe0505e5945460ed698138426c49ed9896f23d3f3b164f18f3b60aa478a0b

SHA512
fbc36beccf74c39d9c0b9f99275da963a7ca9ce0e427bcef26113c42bd202c434b06626c8c58a954f8db8aa74c15321958f101f836ab6d5f9758e78ca1692c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
297209e11ee3cbf3e37171839e99d60d

SHA1
348e28e44b48a8b6b3776e493a773fe3a3ffb2b1

SHA256
00adf353585e616e11fb91caf95f8561f0edd07b2b068bf6a6d4e6f5a686a1bc

SHA512
3a463629ebb850e06094e134d46e2b5e54338a04e4fbd72b7388b0f188416f5b27d502b6c180498f15233a90abe7de9cfe86895cc41210032076f8801a4f6a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2788f6b1a3ad041912086b672c3df75f

SHA1
1bc620d6cb1f47ef02089bbeaab287dfe7a1ee69

SHA256
e462180398354fae848d8ca52567b4f47253769a416a277f588f689fee26387c

SHA512
d874af6fb4d416bb20255e713b0958a7a48819bc25057cc95c7520f75f8ab546f9cb533e1af9fbeffea4a3469e0425af4064e3eff4696bb3896833c0cebdb9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58e1c9c8783a0ed6391354c30d09e266

SHA1
a778fc923716a1e7f7e5ca38caa10894c69dc684

SHA256
e9e83750d649d25c1acbe2693afbc002497581d2bf55ef98605ff2fd127875e0

SHA512
c1c2f196db02a672bd59c1b0baa0fa81ea2a8f005e17f3dad105966672c4f4163b60a6c5df3c5402cbf3596556def32816b66327448e4d1962d20e170ef8f5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6f240b55406d65e8acb024d8d1a050c

SHA1
e44243273f66c8514035ee2180076b94e8fd2b59

SHA256
17c4b7ed94031f989eb49b2eb099a9e2611ed0c8836b81305e32371d625e6ba2

SHA512
0495d4379c215ad8a82b84862b08c91904aad9c3e767b59d2499bdb549d16bce397be1bfdcd348ef0507ed7354ae410f082c9f91b782f69c88a38794a1ace1be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c89.TMP

Filesize
1KB

MD5
cdf8040bac9b58074a4aa12629a26712

SHA1
a5f622eb72334ce6a048c9cb2b8b65967f1a9dce

SHA256
1d336cbed7f7cc11fa81e8e27453941d75a5ff204ef955dc13c661cc267496f2

SHA512
2d437feec138646d82465e78da00bb9c3a0d2aaca87794ce9c6d08a4bde91425731b6503a53c62a2f98a5326ae28c62244025825ae0e2c8aaec24beee8b0fdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
973a81551a418f980bc0f1300009f9dd

SHA1
d19b410cce014553ea56a08f0bd5e9660faff06e

SHA256
d7425f663297949d1946dcc3bb2642df49a8db756bf255b252d4754c33c1c48f

SHA512
5674ed532158732fa309740676fc3ee01b5495ea9b9314f2ccd9406e17ee4e5f4dfdd847ecdfdd5df67b92af4a89f93ced3d54f141a143be61515dd8b61de228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37c55eb75d0e6e93edaaa87a1f49b7e1

SHA1
a2706432be6d4497df466bc7928e427acb6a42ca

SHA256
3028351c69979a07b7204bfb7c97240bb66af74a6f0412d079c10411621dd6f9

SHA512
7f9276ce7aaa2d20b991011e51fb3ea990aca1841033e74c99c8a3b229312a0db3e2eb0eca4dd2227dd172dfb16f80f28fc484cba67b4d58fc64f1dfc4f48163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1e6e87519739b7671272e7408b9dccb

SHA1
69253b7703510c3206725b5c2ad7997866da882d

SHA256
22b6718e22fee36ff0184733e022a8ae47c9f3ff7958e69a0de307a39f944f3d

SHA512
c16aed984358565cb9add9e293e2840e4118c68001d92afab3a63a1b874e4cde3051385752850a025db05d1215119309a7e1290d98b2a86682849999e1de1960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
79a36c0b1d9e07e3aa51c21a66d5271d

SHA1
9dafa58871888cfe7ec8b0ddba58565f7af16c59

SHA256
07e8693a12ce1aece13685a3cd265503fd8d91e2d2f657ef18b8ec19c6a056af

SHA512
24785813e2e466d96d1f4daeb6b49ac5beb60bbb09fef80d48f4bd53d3309e0a2594b9e693dc4698a5a7b12cf2d5ac9c18ca5109436a5c72f15146d41a13e1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
a348b78858608abedab792838e0285cf

SHA1
8268e1f44a3eca60fa828175b6bd5a5f65c65e3b

SHA256
7b69a8c4daa19735f961e4a4c4644b5fb6f3fa13c258b88e9101055abd6be5bc

SHA512
5a2e08a101fc193edabc15f76e0b2be47ec06ed6a1d48e048ff75760558c325c3e60ac029b982c3c55885a872757960454239cd5463c8bb4f9d721dbc90bcca9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 581291.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 794185.crdownload

Filesize
6.7MB

MD5
f2b7074e1543720a9a98fda660e02688

SHA1
1029492c1a12789d8af78d54adcb921e24b9e5ca

SHA256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

SHA512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Download Submit
memory/900-540-0x000001802D530000-0x000001802DE44000-memory.dmp

Filesize
9.1MB

Download
memory/2228-677-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/2228-699-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-703-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-702-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-700-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-706-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2228-709-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-708-0x000000000B380000-0x000000000B390000-memory.dmp

Filesize
64KB

Download
memory/2228-707-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2228-710-0x000000000C460000-0x000000000C470000-memory.dmp

Filesize
64KB

Download
memory/2228-696-0x000000000B1F0000-0x000000000B1FE000-memory.dmp

Filesize
56KB

Download
memory/2228-695-0x000000000B220000-0x000000000B258000-memory.dmp

Filesize
224KB

Download
memory/2228-676-0x0000000000230000-0x00000000008DE000-memory.dmp

Filesize
6.7MB

Download
memory/2552-507-0x00000205DB9B0000-0x00000205DB9CE000-memory.dmp

Filesize
120KB

Download