rhadamanthys | hxxps://solara[.]support

Analysis

max time kernel
147s
max time network
143s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-10-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://solara.support

Score

10^/10

rhadamanthys discovery execution stealer

Malware Config

Extracted

Family

rhadamanthys

https://135.181.4.162:2423/97e9fc994198e76/02dgpgfn.5rkt4

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5448	powershell.exe
5464	powershell.exe
5456	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
3596	Bootstrapper_V1.19.exe
5972	executable.exe
5168	BootstrapperV1.16.exe
5240	BootstrapperV1.16.exe
5640	BootstrapperV1.16.exe
844	BootstrapperV1.16.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
85	raw.githubusercontent.com
86	raw.githubusercontent.com
92	raw.githubusercontent.com

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	SecHealthUI.exe
File created	C:\Windows\rescache\_merged\4272278488\2581520266.pri	SecHealthUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper_V1.19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	executable.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7a284e910418db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f0e94bf5861cdb01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{93B6607A-BEFF-4E6B-BB33-8EDEB796AA = "0"	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 20dd4a910418db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{93B6607A-BEFF-4E6B-BB33-8EDEB796AA = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e3a51b850418db01e3a51b850418db01323025850418db01001a02000000000001000000000000000000000000000000b10314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018007a003200001a02004659ac7b2000424f4f5453547e312e45584500005e0009000400efbe4659ac7b4659ac7b2e00000000000000000000000000000000000000000000000000cef1930042006f006f007400730074007200610070007000650072005f00560031002e00310039002e0065007800650000001c000000ac0000001c000000010000001c0000003400000000000000ab000000180000000300000033987ce61000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c426f6f7473747261707065725f56312e31392e657865000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000756f6b6c79777968000000000000000086268199115cc440bd9a435e365d0b67e2da0f2d87f2ee1192f76e58476ee47c86268199115cc440bd9a435e365d0b67e2da0f2d87f2ee1192f76e58476ee47cd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0034003100300036003300380036003200370036002d0034003100320037003100370034003200330033002d0033003600330037003000300037003300340033002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000000697ff38000000000000d01200000000000000000000000000000000	browser_broker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "435010117"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Bootstrapper_V1.19.exe.06wk3d4.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5448	powershell.exe
5448	powershell.exe
5456	powershell.exe
5456	powershell.exe
5464	powershell.exe
5464	powershell.exe
5448	powershell.exe
5456	powershell.exe
5464	powershell.exe
5448	powershell.exe
5464	powershell.exe
5456	powershell.exe
5972	executable.exe
5972	executable.exe
6096	openwith.exe
6096	openwith.exe
6096	openwith.exe
6096	openwith.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2660	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2660	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2660	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1352	MicrosoftEdge.exe
Token: SeDebugPrivilege	1352	MicrosoftEdge.exe
Token: SeDebugPrivilege	5456	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	3596	Bootstrapper_V1.19.exe
Token: SeDebugPrivilege	5168	BootstrapperV1.16.exe
Token: SeDebugPrivilege	5240	BootstrapperV1.16.exe
Token: SeDebugPrivilege	5640	BootstrapperV1.16.exe
Token: SeDebugPrivilege	844	BootstrapperV1.16.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1352	MicrosoftEdge.exe
2632	MicrosoftEdgeCP.exe
2660	MicrosoftEdgeCP.exe
2632	MicrosoftEdgeCP.exe
2456	MicrosoftEdgeCP.exe
4264	SecHealthUI.exe
5900	SecHealthUI.exe
5920	OpenWith.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2632 wrote to memory of 664	2632	MicrosoftEdgeCP.exe	79
PID 2424 wrote to memory of 3596	2424	browser_broker.exe	82
PID 2424 wrote to memory of 3596	2424	browser_broker.exe	82
PID 2424 wrote to memory of 3596	2424	browser_broker.exe	82
PID 3596 wrote to memory of 5448	3596	Bootstrapper_V1.19.exe	96
PID 3596 wrote to memory of 5448	3596	Bootstrapper_V1.19.exe	96
PID 3596 wrote to memory of 5448	3596	Bootstrapper_V1.19.exe	96
PID 3596 wrote to memory of 5456	3596	Bootstrapper_V1.19.exe	97
PID 3596 wrote to memory of 5456	3596	Bootstrapper_V1.19.exe	97
PID 3596 wrote to memory of 5456	3596	Bootstrapper_V1.19.exe	97
PID 3596 wrote to memory of 5464	3596	Bootstrapper_V1.19.exe	98
PID 3596 wrote to memory of 5464	3596	Bootstrapper_V1.19.exe	98
PID 3596 wrote to memory of 5464	3596	Bootstrapper_V1.19.exe	98
PID 3596 wrote to memory of 5972	3596	Bootstrapper_V1.19.exe	102
PID 3596 wrote to memory of 5972	3596	Bootstrapper_V1.19.exe	102
PID 3596 wrote to memory of 5972	3596	Bootstrapper_V1.19.exe	102
PID 5972 wrote to memory of 6096	5972	executable.exe	104
PID 5972 wrote to memory of 6096	5972	executable.exe	104
PID 5972 wrote to memory of 6096	5972	executable.exe	104
PID 5972 wrote to memory of 6096	5972	executable.exe	104
PID 5972 wrote to memory of 6096	5972	executable.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://solara.support"
1⤵
PID:2412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1352

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Bootstrapper_V1.19.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Bootstrapper_V1.19.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\SGDT'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- - C:\SGDT\executable.exe
    "C:\SGDT\executable.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\SysWOW64\openwith.exe
      "C:\Windows\system32\openwith.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2520

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5168

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5900

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5920

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SGDT\executable.exe

Filesize
423KB

MD5
844b868dabe70a2748c5f86c327e9391

SHA1
1d5ec1aa30faef047cda55d09b528046f275b9ff

SHA256
c339bc88c7ecc7c7d099e8457e16a7094fc2243e68ec30041d048b4f97b224c1

SHA512
92d93457a93969dbe3b8fcfb120be7cec97fc38646aa5b08b926ed2c909f3872ed00ff27f0b8423e7ad1d8dedb72511893504e8a6658cd9c35de0ce7c9151859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VSH5XF98\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d316209546808b913917a83db007c351

SHA1
6492ef7e10193b51c3ccc4bb47eed3fb038e0850

SHA256
3886ecf8e348e6087484f521d446e715957b96eb2a01ba271979c7c2aee29dc3

SHA512
2d190820fd99d3da62369f7ac3506ec82d950fea704089cb59cf42be9a6b38b5a16662504a018c7d2e2c84d935016c7a04cda720c5215f584067998ae53e29ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b6c3a2f4b18368ff45e1c5c095800e22

SHA1
9102dc15b939e48eaeb20b3964e1ec6a86d6e67c

SHA256
736dee70b09f716255bca5a5127eba395447137d40dfc5971ad83d801b484254

SHA512
c0341b09875250344cf24e919840100bb748aef4ae557606f67e26cbb6c016e5de5cfb5607aa68cdc4d50f5be5a948aa1acee1526dd51b8c7f5ce9a1e5edce99

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\A2A10E79\redesign[1].js@id=7241df38335b9e6d6ee2

Filesize
1.7MB

MD5
7241df38335b9e6d6ee2ba354a2c673e

SHA1
a0c0ca2a3ebf7d11888c9de3036fcd28f560f02b

SHA256
d229a811e301854fda802f244da8ec66594c638223d8f3a8f1b85c2ecc498277

SHA512
3a9be805ef087584f3d122d9a7ccaafe1b676673cb9ed9477a32a9a999ac83438f6d67f48e8cfd2fbd42387fea2ba087be24a9284256b2bcb30869554dd27693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ME4J57ZX\Bootstrapper_V1.19[1].exe

Filesize
134KB

MD5
e86843fd1931a45196d44ae99c75d185

SHA1
a18d71b4531acd21b2d72fbceb9d10f87b81f3a0

SHA256
8b26fe4e3151ca112d370dfe054a092160e7aa42d8b3ede87f8eee44ea6e100a

SHA512
2949a66a98746b0798fcbd1ae2fa749a4d9019b1764c46273daec653f47eddc65d18280d6e2cd1fa58e4ae0f9c92803a6666d22a57e98d434887e57b9533cc02

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\490FA26Q\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JMXSNVN3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\MR7079ZQ\Fav[1].ico

Filesize
4KB

MD5
b668a9dbbd13097cf3939bf8d3b0130f

SHA1
fd73d5ce0c6f1c5e4eccf9f192000d646a22e821

SHA256
1aa10896fc604ca798d82ffe8d8b99cfbfcac402a63444624e01a8c5af8e8b6e

SHA512
f926f752dc249ec9c6c1d838c0d153a94ade3ed3307701426b1ef95d09142ea3b0e093fa7aa2b0ab2241c03948179009ca90dbabb58af24156cd47e21d2e7420

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Bootstrapper_V1.19.exe:Zone.Identifier

Filesize
137B

MD5
f2b23e946adf99c8c70158126936c813

SHA1
a54a32b51afeec0537f8eb0f42a1e04bb9bb3c69

SHA256
1ddc1f6f2ec2ade3c126e9a253114b0f7bb3e5de0c3e75ed1e05adf94eb3ce9b

SHA512
96e46cef85cb71e15b4f0ac8023e03d188071d6b7652c39f463efd58ca86ee4f2d74df212b8084a17de6ecb93032bc74594d3a323be8cb41027f08d12a372ff6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ME4J57ZX\Bootstrapper_V1.19[1].exe

Filesize
12KB

MD5
410f47ecc577e364f71d5aaa9d8e1365

SHA1
02d8b6460f13c902a1df3d79f7db01ef1fc0bb94

SHA256
c6a912dc351114a3a97c7f801c4acb031fb26f6766c445340d050c1c44d6c92d

SHA512
a304887216b7d8dc3bcc01b66cf5e75bc02a5f2f9551c7e685f4a7b964e012a770959ece1a79a00cdb3c75ab91ffe5df6645fa790794d403e172c9e4d14f866d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.sechealthui_cw5n1h2txyewy\AC\Microsoft\Windows\4272278488\2581520266.pri

Filesize
70KB

MD5
dc37deff2947a4ec8bf9b40a3dc25c49

SHA1
422bdce2dc21c634760c8b06a60c4ebf131cc592

SHA256
00dee1b03565baf7c105f1484f27a2e04d900538c153372482fbedd8cde61d85

SHA512
bbe9730344e0f648c53d2d5c518791ce8d92c1f04e1b9646bb4feca24d5f41fae255eff57ad7c36ff1d26869ad25eede25bbd4e98a59267d41ee71f3885d9dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxpzlyfe.o2h.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\Desktop\DISCORD

Filesize
103B

MD5
487ab53955a5ea101720115f32237a45

SHA1
c59d22f8bc8005694505addef88f7968c8d393d3

SHA256
d64354a111fd859a08552f6738fecd8c5594475e8c03bb37546812a205d0d368

SHA512
468689d98645c9f32813d833a07bbcf96fe0de4593f4f4dc6757501fbce8e9951d21a8aa4a7050a87a904d203f521134328d426d4e6ab9f20e7e759769003b7c

Download Submit
C:\Users\Public\Desktop\BootstrapperV1.16.exe

Filesize
972KB

MD5
90fd25ced85fe6db28d21ae7d1f02e2c

SHA1
e27eff4cd4d383f5c564cce2bd1aaa2ffe4ec056

SHA256
97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f

SHA512
1c775cf8dfde037eaa98eb14088c70d74923f0f6a83030a71f2f4c1a4453f6154dab7a4aa175e429860badda3e5e0ae226f3c3e8171332f5962bf36f8aa073fa

Download Submit
memory/664-109-0x000002161DD80000-0x000002161DD82000-memory.dmp

Filesize
8KB

Download
memory/664-99-0x000002161DF70000-0x000002161DF72000-memory.dmp

Filesize
8KB

Download
memory/664-176-0x00000216208B0000-0x00000216209B0000-memory.dmp

Filesize
1024KB

Download
memory/664-58-0x000002160C700000-0x000002160C800000-memory.dmp

Filesize
1024KB

Download
memory/664-101-0x000002161DF90000-0x000002161DF92000-memory.dmp

Filesize
8KB

Download
memory/664-167-0x000002161CE80000-0x000002161CE82000-memory.dmp

Filesize
8KB

Download
memory/664-103-0x000002161DD20000-0x000002161DD22000-memory.dmp

Filesize
8KB

Download
memory/664-111-0x000002161DDA0000-0x000002161DDA2000-memory.dmp

Filesize
8KB

Download
memory/664-113-0x000002161DDC0000-0x000002161DDC2000-memory.dmp

Filesize
8KB

Download
memory/664-342-0x000002161DA60000-0x000002161DA62000-memory.dmp

Filesize
8KB

Download
memory/664-344-0x000002161DA70000-0x000002161DA72000-memory.dmp

Filesize
8KB

Download
memory/664-346-0x000002161DA80000-0x000002161DA82000-memory.dmp

Filesize
8KB

Download
memory/664-115-0x000002161DDF0000-0x000002161DDF2000-memory.dmp

Filesize
8KB

Download
memory/664-105-0x000002161DD40000-0x000002161DD42000-memory.dmp

Filesize
8KB

Download
memory/664-107-0x000002161DD60000-0x000002161DD62000-memory.dmp

Filesize
8KB

Download
memory/1352-16-0x000002571C020000-0x000002571C030000-memory.dmp

Filesize
64KB

Download
memory/1352-162-0x0000025722CD0000-0x0000025722CD1000-memory.dmp

Filesize
4KB

Download
memory/1352-161-0x0000025722CC0000-0x0000025722CC1000-memory.dmp

Filesize
4KB

Download
memory/1352-35-0x000002571B070000-0x000002571B072000-memory.dmp

Filesize
8KB

Download
memory/1352-0-0x000002571BF20000-0x000002571BF30000-memory.dmp

Filesize
64KB

Download
memory/2456-283-0x0000024312000000-0x0000024312020000-memory.dmp

Filesize
128KB

Download
memory/2456-275-0x0000024311500000-0x0000024311600000-memory.dmp

Filesize
1024KB

Download
memory/2456-274-0x0000024310F70000-0x0000024310F90000-memory.dmp

Filesize
128KB

Download
memory/2456-242-0x0000024300B00000-0x0000024300C00000-memory.dmp

Filesize
1024KB

Download
memory/2660-45-0x000002C241F00000-0x000002C242000000-memory.dmp

Filesize
1024KB

Download
memory/3596-426-0x00000000009A0000-0x00000000009C8000-memory.dmp

Filesize
160KB

Download
memory/3596-427-0x0000000009AA0000-0x0000000009AA8000-memory.dmp

Filesize
32KB

Download
memory/3596-428-0x000000000A930000-0x000000000A968000-memory.dmp

Filesize
224KB

Download
memory/5168-1219-0x0000017CBBB80000-0x0000017CBBC7A000-memory.dmp

Filesize
1000KB

Download
memory/5448-1082-0x0000000009D90000-0x0000000009DAA000-memory.dmp

Filesize
104KB

Download
memory/5448-464-0x00000000089E0000-0x0000000008A56000-memory.dmp

Filesize
472KB

Download
memory/5448-511-0x00000000098D0000-0x0000000009903000-memory.dmp

Filesize
204KB

Download
memory/5448-521-0x0000000009C10000-0x0000000009CB5000-memory.dmp

Filesize
660KB

Download
memory/5448-515-0x00000000098B0000-0x00000000098CE000-memory.dmp

Filesize
120KB

Download
memory/5448-514-0x000000006C700000-0x000000006C74B000-memory.dmp

Filesize
300KB

Download
memory/5448-1117-0x0000000009D80000-0x0000000009D88000-memory.dmp

Filesize
32KB

Download
memory/5456-460-0x0000000006C70000-0x0000000006CD6000-memory.dmp

Filesize
408KB

Download
memory/5456-461-0x00000000077B0000-0x0000000007B00000-memory.dmp

Filesize
3.3MB

Download
memory/5456-458-0x0000000006B60000-0x0000000006B82000-memory.dmp

Filesize
136KB

Download
memory/5456-459-0x0000000006C00000-0x0000000006C66000-memory.dmp

Filesize
408KB

Download
memory/5456-457-0x0000000006DD0000-0x00000000073F8000-memory.dmp

Filesize
6.2MB

Download
memory/5456-526-0x000000006C700000-0x000000006C74B000-memory.dmp

Filesize
300KB

Download
memory/5464-531-0x0000000009D30000-0x0000000009DC4000-memory.dmp

Filesize
592KB

Download
memory/5464-463-0x0000000008790000-0x00000000087DB000-memory.dmp

Filesize
300KB

Download
memory/5464-454-0x0000000004E20000-0x0000000004E56000-memory.dmp

Filesize
216KB

Download
memory/5464-520-0x000000006C700000-0x000000006C74B000-memory.dmp

Filesize
300KB

Download
memory/5464-462-0x0000000008430000-0x000000000844C000-memory.dmp

Filesize
112KB

Download
memory/5972-1189-0x0000000000A10000-0x0000000000A8E000-memory.dmp

Filesize
504KB

Download
memory/5972-1210-0x0000000000A10000-0x0000000000A8E000-memory.dmp

Filesize
504KB

Download