rhadamanthys | hxxps://www[.]mediafire[.]com/folder/85txqbn671ucv/rbscrpt

Analysis

max time kernel
148s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05/02/2025, 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/85txqbn671ucv/rbscrpt

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral1/memory/4660-472-0x0000000004390000-0x0000000004411000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4660-471-0x0000000004390000-0x0000000004411000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4660-470-0x0000000004390000-0x0000000004411000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4660-468-0x0000000004390000-0x0000000004411000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4660 created 3064	4660	Developed.com	49
PID 3392 created 3064	3392	Developed.com	49

Executes dropped EXE 3 IoCs

pid	Process
4660	Developed.com
3392	Developed.com
2440	Developed.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
2568	tasklist.exe
728	tasklist.exe
5472	tasklist.exe
1932	tasklist.exe
3080	tasklist.exe
5960	tasklist.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PropertyDamaged	New v1.0.1.exe
File opened for modification	C:\Windows\WorkshopsDynamic	New v1.0.1.exe
File opened for modification	C:\Windows\WorkshopsDynamic	New v1.0.1.exe
File opened for modification	C:\Windows\ExpenditurePerformer	New v1.0.1.exe
File opened for modification	C:\Windows\PropertyDamaged	New v1.0.1.exe
File opened for modification	C:\Windows\SteelCorpus	New v1.0.1.exe
File opened for modification	C:\Windows\ExpenditurePerformer	New v1.0.1.exe
File opened for modification	C:\Windows\CasinosMoscow	New v1.0.1.exe
File opened for modification	C:\Windows\SteelCorpus	New v1.0.1.exe
File opened for modification	C:\Windows\YieldDublin	New v1.0.1.exe
File opened for modification	C:\Windows\TravelerCourage	New v1.0.1.exe
File opened for modification	C:\Windows\PointPromising	New v1.0.1.exe
File opened for modification	C:\Windows\RevealNorfolk	New v1.0.1.exe
File opened for modification	C:\Windows\YieldDublin	New v1.0.1.exe
File opened for modification	C:\Windows\TravelerCourage	New v1.0.1.exe
File opened for modification	C:\Windows\RevealNorfolk	New v1.0.1.exe
File opened for modification	C:\Windows\SteelCorpus	New v1.0.1.exe
File opened for modification	C:\Windows\WentMomentum	New v1.0.1.exe
File opened for modification	C:\Windows\PropertyDamaged	New v1.0.1.exe
File opened for modification	C:\Windows\CasinosMoscow	New v1.0.1.exe
File opened for modification	C:\Windows\RevealNorfolk	New v1.0.1.exe
File opened for modification	C:\Windows\WorkshopsDynamic	New v1.0.1.exe
File opened for modification	C:\Windows\CasinosMoscow	New v1.0.1.exe
File opened for modification	C:\Windows\YieldDublin	New v1.0.1.exe
File opened for modification	C:\Windows\PointPromising	New v1.0.1.exe
File opened for modification	C:\Windows\PointPromising	New v1.0.1.exe
File opened for modification	C:\Windows\WentMomentum	New v1.0.1.exe
File opened for modification	C:\Windows\ExpenditurePerformer	New v1.0.1.exe
File opened for modification	C:\Windows\TravelerCourage	New v1.0.1.exe
File opened for modification	C:\Windows\WentMomentum	New v1.0.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2296	4660	WerFault.exe	115
5420	3392	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New v1.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New v1.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New v1.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Developed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Developed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Developed.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\R---3----L-.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
912	msedge.exe
912	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
5208	msedge.exe
5208	msedge.exe
4660	Developed.com
4660	Developed.com
4660	Developed.com
4660	Developed.com
4660	Developed.com
4660	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
4660	Developed.com
4660	Developed.com
4660	Developed.com
4660	Developed.com
1744	svchost.exe
1744	svchost.exe
1744	svchost.exe
1744	svchost.exe
3392	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
3440	svchost.exe
3440	svchost.exe
3440	svchost.exe
3440	svchost.exe
2440	Developed.com
2440	Developed.com
2440	Developed.com
2440	Developed.com
2440	Developed.com
2440	Developed.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5472	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeDebugPrivilege	5960	tasklist.exe
Token: SeDebugPrivilege	2568	tasklist.exe
Token: SeDebugPrivilege	728	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
4660	Developed.com
4660	Developed.com
4660	Developed.com
3392	Developed.com
3392	Developed.com
3392	Developed.com
2440	Developed.com
2440	Developed.com
2440	Developed.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4216	912	msedge.exe	77
PID 912 wrote to memory of 4216	912	msedge.exe	77
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3496	912	msedge.exe	78
PID 912 wrote to memory of 3416	912	msedge.exe	79
PID 912 wrote to memory of 3416	912	msedge.exe	79
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80
PID 912 wrote to memory of 5076	912	msedge.exe	80

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3064
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/folder/85txqbn671ucv/rbscrpt
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82adb3cb8,0x7ff82adb3cc8,0x7ff82adb3cd8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,3469392707439322190,8552500369456208710,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5340

C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe
"C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c expand Provide.pptm Provide.pptm.cmd & Provide.pptm.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1928
- - C:\Windows\SysWOW64\expand.exe
    expand Provide.pptm Provide.pptm.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1912
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 287105
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Bald.pptm
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Recently" Masturbating
    3⤵
    - System Location Discovery: System Language Discovery
    PID:780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 287105\Developed.com + Webcams + Rogers + Sublime + Photo + Sacramento + Remainder + Pounds + Recruitment + Exact + Wedding 287105\Developed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Japan.pptm + ..\Applied.pptm + ..\Following.pptm + ..\Triumph.pptm + ..\Kazakhstan.pptm + ..\Given.pptm + ..\Fit.pptm + ..\Content.pptm + ..\Un.pptm m
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\287105\Developed.com
    Developed.com m
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:4660
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 960
      4⤵
      Program crash
      PID:2296
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692

C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe
"C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c expand Provide.pptm Provide.pptm.cmd & Provide.pptm.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5548
- - C:\Windows\SysWOW64\expand.exe
    expand Provide.pptm Provide.pptm.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 287105
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Bald.pptm
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 287105\Developed.com + Webcams + Rogers + Sublime + Photo + Sacramento + Remainder + Pounds + Recruitment + Exact + Wedding 287105\Developed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Japan.pptm + ..\Applied.pptm + ..\Following.pptm + ..\Triumph.pptm + ..\Kazakhstan.pptm + ..\Given.pptm + ..\Fit.pptm + ..\Content.pptm + ..\Un.pptm m
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\287105\Developed.com
    Developed.com m
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:3392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 932
      4⤵
      Program crash
      PID:5420
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4660 -ip 4660
1⤵
PID:2260

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3392 -ip 3392
1⤵
PID:2304

C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe
"C:\Users\Admin\Documents\Release\Release\New v1.0.1.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c expand Provide.pptm Provide.pptm.cmd & Provide.pptm.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5164
- - C:\Windows\SysWOW64\expand.exe
    expand Provide.pptm Provide.pptm.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:728
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 287105
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Bald.pptm
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Recently" Masturbating
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 287105\Developed.com + Webcams + Rogers + Sublime + Photo + Sacramento + Remainder + Pounds + Recruitment + Exact + Wedding 287105\Developed.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Japan.pptm + ..\Applied.pptm + ..\Following.pptm + ..\Triumph.pptm + ..\Kazakhstan.pptm + ..\Given.pptm + ..\Fit.pptm + ..\Content.pptm + ..\Un.pptm m
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\287105\Developed.com
    Developed.com m
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2440
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5e2180e959653a5f5ef38b81e2ecc342

SHA1
7626b0cc8f2f55dbeae79acf3f0884c277a7252d

SHA256
18042c9b731a44cfb3b854ac8956b58d92b42cf7d013c47e466d5c98db86fc5b

SHA512
e03f1bc1601044f5b0b33eeee2ca03e0b822a060975e6299ee8a8086b2aadedd8b58971ace8e54b5cf9877533c9716f799c1e45db2ecd7fb7237e5c028bc7304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9f45a8d5b0c3eeb8c6a3a788d1c066c6

SHA1
a9d0c0b825342e1036d01da26f0b827b78ae24a0

SHA256
fd7842e4db320941323a6ba137f8a45955bf6dc504e5ca15d6be690db48e22a3

SHA512
adde2c5c3038d44ead58f56bdb99f07b28b631fa6e07655e7c4e9183e4f9a88d4e268074d857a2c5aba629530a7ff64ed744aea621db04659abfab204533ad02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63d7aebd9b95c8d8792bb8e69ad80895

SHA1
449d8b094c0fa0b14cc3eaf805d121035f1d4c44

SHA256
ccbe8611d553bd5115ae7e170fdf4d349e8f237e46b42de8a0221538d837fbd7

SHA512
eb8b3552340631e2ee577cade20b45f250d7c98147d8a8dc7ae0fc98bf53a5c38fd7464b1658f7ec3c32737610ed4316f21e6dd92ec3dc5b5bfa92a0dd7580de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bac230f33d0fcd757eacd7a2ebc6bdb5

SHA1
23e23688db8ad3bb6d0de00943b1fb10fa6bcdaf

SHA256
d0a54bd0f41d5a1b35f9f042301fa7b1d4506d27492f6928eb13da6aecf937e1

SHA512
14b25a49284dd9e795ca9b71ee539365cf9a72a4f308082b6bec47924cbfa1ab6c4e48bb7397cfeaf6092775fb5fddd920e8178397187977f3e7459bcf249392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6bf91bde9540b749b42054c1ce0151d0

SHA1
1f9259f3d07f49f10fcfc41b130e00de1414d636

SHA256
1b1b7b624ff3d0c5c79c5a174da170c20bad6b38bc3aeee2bb4239b7738de495

SHA512
804d3b021a89cc7338ce2ba6d9224729f0d9f0109614d2d5d5e3496110cc6a719fe050c2e7db7445db59bfacc27d19633c3086dceafbe3983772aa1ef7acdea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fcce115e7901553e45b8a50d5672e65

SHA1
c4e0016632f9a9048151d799d8cd2f7fc40739e3

SHA256
8cd970f99da67f0ed7ead65b76c056a959b9d7738e6e56a0d148bc30c38e8c9d

SHA512
129bb89c1cdbdb28fd98a51c97101f99a65143296bb58f30b2479357926543dcbc3f252fda1593ec5de6bcd6f29ec672b26bcb8d96299764da8a91fc7ab91780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b9f35a82feac648aed33aa5a43eec79

SHA1
8da4a174f6fabe162f996aa45a8db9dbef45c4db

SHA256
449d74bafb2dac32bf5a47bdbf3711059bce477f105fc6e29e89f540c8d223a7

SHA512
71e3352151929b5cb63158f1f96bc7c9224d33cc89807be60469770510b4ac63703089d263525fff058936f91b46d24e829cee3a51f28a78c825dfefe485886e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae21b8925d85648688bc4064bed50cfd

SHA1
c6b9c4f814038dc5ea1925235db691f72cad9724

SHA256
c66489460a06b4d1914e123398d12055ecfce99cff799b8e253aabd86e63257f

SHA512
33b383cedcfa363e836223e805b6757a619be098a9179cb9d5a8a2da6b6d6dc85ea7febcf7339a5183f76af1524dfd85e183d6dc34eb3d59c96c77a64b8ab51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
753c7c84a9777f3fc54a9a3ec08a771c

SHA1
90c008b9d66247bc69b9b89f06a1e190dc19bf19

SHA256
446cca3aca8bd1b4ff9c3182c3334afb813a59c6b3325d0753ef13ade99baa62

SHA512
1537ec7839cf5966a014418b82f822a01aad61de9965092225c92e1bc2db8fd0b534a76b5a9f80006a03afda693c2ea0b7e7c76db9026d8dac088f2f8362f73a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9365a43e5fdfa0488a0d66fd658ef5be

SHA1
6f8f992b5b772e92fabe2d837b08b1cb787c182b

SHA256
e9c5412b097007b2798376745fe1afcf6340557b882969c7af599a56781544d7

SHA512
ed461c82a1391c8a945e2cf512187677b48a4875de4813bb0d3173275ef052f036d0dd9ba6a6388b171efc380e2b0ff2d1f2f4ba6121877406061d9be67dd130

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\71ef0d4f-38df-419d-9920-d92e7c49ea19.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\287105\Developed.com

Filesize
484KB

MD5
c11daaa2c1e5cd4f5e8adb83735682e9

SHA1
656197e83fe45aa42eba1012f4b0cbf349040e98

SHA256
18ef36269abae119e06e55cc25beb7b26882f1dbd452ede87ede6b7dbb0a2095

SHA512
e4d88faa02053b5efddcfedf6cbc3f3115a0396f03b0b74b18d2daaee0809da04becffe050455ebed94d966135b93a48a37181d6e4ddfdfa25b38c1cdff7f4e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\287105\Developed.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\287105\m

Filesize
673KB

MD5
14e097512474943dd195f0b30c87b7f7

SHA1
2a16d0f74a68d989b53f484bc1ec54f6fb7632ae

SHA256
ec0eed4bb75b41002774c397c093ea41e981c9ce28d55cd2690295e03eb344b0

SHA512
f85565f506cbcbd859cf8f423b0af320f73a999261b113e796e22ad85309e8487ee91d681e040c510e356a89597f7147b2ebe3673b8861ef09c110e541a58e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Applied.pptm

Filesize
80KB

MD5
c2262bfb09d645db0c06395babe0b20f

SHA1
ba085fa2ead81137cc8072b224a7c43a1459c7c7

SHA256
03a5c405ae6ae3992d0be7d28f3b60b846cd18c3827ec9b7c58530900495b022

SHA512
f3f0a0f4d1ca0dcc50a253e4e108f1bae1851eaefd7f50d9ce6c90d1f28921d0a9167e06df8db439043b48895f512851bb6599cee36ece404c20c5e152510894

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bald.pptm

Filesize
477KB

MD5
c2ec350cdea575f27e21a43694102eef

SHA1
ecccc466a1be4bfd5ad1014a06201820c08336c1

SHA256
3fa7eb0e7a5a6dcc42b978dd672da43ca2a79957b4b6d1ab5c1f9f63c73dad22

SHA512
4c741d720af9932b0901b8642297dea322ce73e171582b813cca26f77c225312c4187b3ed9984bffa78157b207db51aa81b2d55059640325a0a51e2c69f9dfd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Content.pptm

Filesize
96KB

MD5
2b860747406145531d4cced7f6c8cf5c

SHA1
1dcc7a8bf5759ae04c65c856b49feeb30b99cf19

SHA256
5bad454d2be1bc359ad051513a55c8fc27b876333ef69fe76dab7ecbe7de7017

SHA512
7164dc8ae5e4ae1af2ead4aef609326113c365dcdeed978a70b8077300765fec2d82e10e2c36095642f0ce31d7986b9f819415349c3f02d8727f5d63720136de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exact

Filesize
69KB

MD5
f58829b6eef3cacaeb1277e389c1549c

SHA1
7aa6817a2bd3e524c8a0bf11db33bf173b27f5dd

SHA256
9fb89c7638d730dbb98b8631f63be7fc0f4443d526f50028dc358e06fe6f8f70

SHA512
d8c6aa3405fbbbe638e40c04e43e8be9040e9c985eea26337bae2a82317d6b6672b0257801e28bbf68cebd4a72276d624e5396e30f5cb52165657fa7eccf446a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fit.pptm

Filesize
50KB

MD5
f4f6c0a1b358634af4c077f06b56de1c

SHA1
4d7846a07da37a51f3508713d45cd600986cfd0f

SHA256
e5d3fc72f8e58f147b3e62aa9599e87595b53d34e14045c16efe3e2ab4125f09

SHA512
01871b77e9806b08363a918010a287300b91da4c57b3b04bfa5a34377f39ae61a47c8a32b228c02b37101dbad5adc95b3229e31018dc4314db54ba53ee991883

Download Submit
C:\Users\Admin\AppData\Local\Temp\Following.pptm

Filesize
65KB

MD5
80d390b7eddec0ed744c81dd1f735c34

SHA1
b5dfafaea1a0590c011b91a42790c4062e3ea9fa

SHA256
95ecef6d61a5d220af46a6d434d4943a1908d51ae8ebaf2aaabb8d8530e57f99

SHA512
e28cb4bb2d1257e1d463fdd0acb1b5a791fe1204f0b90a560c41ac6a8f8085a110615743173b320c98d054a1e6137661d9c799647ecef87a73064050cbe6fe86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Given.pptm

Filesize
77KB

MD5
7858a671cbccb4b1a58cf5927e380052

SHA1
37308fc61ea3fbdfce2ef366b917d8fa2f1af48c

SHA256
b0c331b120939617f0fbc42a721f80600107d68013e8e93f82d7f100d342f733

SHA512
dffce567a72161a8c2ecdd1881d895aa177f70d564cb4c0b2cea8f12b62cb6b8ef831b3047b0dcaec32c6878498f49af13c7fa7813a5f1b70cd9e2ac11449e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Japan.pptm

Filesize
68KB

MD5
4e9dfeb3d807bf88510f884b84148151

SHA1
04f74bed2990712bade7c7bf32a23db2c6b399bf

SHA256
4d71724a7a7d84a6e6eadb2817e08c4228b1d597e440ec02f97d4dfc2318a06b

SHA512
f2015c4c8117855ac69109ff0e7bc01b7e49704a626e4a8008f406693ed416fa3ceb00bd229c188642b11f60b3db26659586fbf22e9d3b66b0db6ab1b6040a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kazakhstan.pptm

Filesize
94KB

MD5
2dfd15d53b56dfd915a7d4d4422a13e1

SHA1
6c0614b99619379a4c15084aaa1c26041795128d

SHA256
6d80930468c7f246acfdca43e9dd65ff60491e10a298adb693ff4963363a8ad6

SHA512
89fd8cab0d9a12c70c621433aa25fcc181c29b1e03525de51674a91132d1e942fe93fdec0ab711c4b436eee778149982233bd1c257e53f6937e12c064e373603

Download Submit
C:\Users\Admin\AppData\Local\Temp\Masturbating

Filesize
828B

MD5
041ed7b3a27de6b3b67a7cfbc5fb859f

SHA1
add6e0a6b3103cea298197d3cdb40db90eebea53

SHA256
5be83c7377cf1137e599e6182996da0248c13971d3d2342cc5a27e2676d11f4a

SHA512
68dda1dc100f392d3d16813626dbb8d4f288b9d9aca259b3d862e3f39854c49691bb2da50a27325847ac783f4209d7d4f7aa31568373ae842f748f04f9bed281

Download Submit
C:\Users\Admin\AppData\Local\Temp\Photo

Filesize
103KB

MD5
9ef1521e8b842ed9e837e7bfe2c88099

SHA1
6048c3c73c81611c02144c7a3eace5e5e509f407

SHA256
cb68029d88d87a827f57968360cc63f70a2d50d56a9c65f4fd027484276ba28f

SHA512
c872baedd082958aa7c8519b1a6a0a4d921efc72e29e64129b70da91a02e1554a1dbe7792c1000d5ea064ca52ebd2d75a1d17b9a7b4f2af3c58a5bc39013dcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pounds

Filesize
89KB

MD5
bd2c92eec11a4da5036564ae42bd476b

SHA1
6207bc2396b580f29a440894b5523e9fe03a6d57

SHA256
3a28726b0f4fd2457208c5a0a1d16281b282aff1552c150af4fa7afb59f96665

SHA512
28ae30671a4cee7c46918a460b6202ea407401ddf2f1310adfefb091f43743d4c0ce77290c8c0be464bf6287dad0fb346b2049ce957be70eec717d78282eff72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Recruitment

Filesize
130KB

MD5
3e74706c275ce25eb682d06d1fc09965

SHA1
a2e311ef9446e3eb399ac5b3131487b4341fe8fd

SHA256
38bd31b7f94b810d2a377343124d32cd8ad804321299dfb720dd9c3e9c3852bb

SHA512
95125e3ded0b65e9a7b0e2bea9906fdb191cd4282dd5db75f359f1886890791a58e3cf5e35d7685c984c0445477287e8d7cadf1768ec968e63f9865de4d94836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remainder

Filesize
144KB

MD5
126c0f61e886df5be90e20d8fcba6f2e

SHA1
974fc9da1b28abe906cda09061828ef0be813ba8

SHA256
ebddae059864c00c0ecd6746aa26d6aeeb498e47af18b5f4bf483b93eec78bdd

SHA512
b5662b85502a48593cd5e083743a171e6a6704c12dfd7be689e7eb9bc6833967a00121d421a33cb1bb3c2023ca826f62098caba73aec63a1ae8c83d0efe0149d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rogers

Filesize
110KB

MD5
d52848a093c557cc8507e77a123ece44

SHA1
676ef58484397b96a2378cd9ea2c58016aa9de20

SHA256
b88f06ca0aedf7402d8112015cfb2f9c4e3d5a8f7822253a85913f02db72832f

SHA512
8089cb6f5bd31fef3be8ddd483e0d1a449af6a7b51b7cda0374917d00014e864386ef385d7d6ca5ad5a3b4e252fd09ed147f10cbbb2cf6c552427381b6233066

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sacramento

Filesize
83KB

MD5
fd914a82afbe6525ae0ddea5dde67fc0

SHA1
4fd92e6e5acdda0edeb859d40d93f580d1b5ff4c

SHA256
072761680524501e7ab2fc6df7c0c9c492432dc36d27858483fd39065c582a22

SHA512
a0f51a69c22ebfafc090c42dea2c4b01cf236a4a46134480d4c6ff50eb120c4b68abbeae2f6078e37635ca0e2e79cadd3368ce6d97e0903839468007faa71aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sublime

Filesize
108KB

MD5
143739c6b7b4c0cd3e4828082e0b72ec

SHA1
5d789debb39640f9e2686fd720ebaae79710c4e7

SHA256
335c6b21c81196733ebcf5bbb9576c27aeb8d172576dada9ec5dd3e54abcf598

SHA512
b306871a6f752c4e63337304848e5dadd43ee5b21e9416cdb60cfda0b24f0458542ef4defa2e623f2f01bc485b12929982b6d443e0980e512fc1efce84f79f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Triumph.pptm

Filesize
96KB

MD5
cea37fbff6db561a8de5c0d50c365509

SHA1
540d9c42e75fd00d6f24df9c22653751c1fbb6e5

SHA256
e721dd65f9628c5358b7d72542ae35f60674d23643f3c52540dcd0097ecbf578

SHA512
37a1173886ea0b96ddd6df9aec8e11f9fb4f543d38895713d8d83574fb652ddb018d2c63f87a43127b0fd5f85c3e068df942856c99b89f01f726f15fd419fbd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Un.pptm

Filesize
47KB

MD5
feb29fd7ba58d4be2a7f9b35ecd6e45a

SHA1
d342dd48cb879f918955917219f3641183b4e0fd

SHA256
7b94a40ee4ffcb0a706e02dc08d0246f6efa42d50fb334616fd384b9d9c92958

SHA512
09fda3e66523d6ce403a4b5919ed9f1e3e6871e0c4cce87ac330b2aaf7e273c19c3018cd045cdae13d672a6cfb6758bfc311c7749e5936bd00fa2488bec9ab5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Webcams

Filesize
80KB

MD5
cd710337318873a57440ee2ee13567f3

SHA1
a1f4ba1d3635c06a26dba41d7c5705bfc46fb095

SHA256
c26b4102798d5aa1f37cb1b95a9f867fd904ef9b7699ab944975bfca4715eb85

SHA512
49b9c2fe71fea6cf59ea243e22db2c9ba1cd901eecd543431debc9088a90d4aeb96bafb04f78de3906bf2c356fcd62f814df9ed6cec87177aecf0503e8c5ce3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wedding

Filesize
8KB

MD5
541aef661de08689603f18ca967b0abd

SHA1
a274b7259591b5ddd96e44524b325b31b81da781

SHA256
32c56ab0639f464c818409b1505d1518d0749a0f43be3e974d2e0ef759efcb41

SHA512
6183270fd035721d8590831a0f53c7849e8d007132b9e49de4f9f4b5ddb3fcd3b2fc0885424a75993965a7c5aabee7e674a8e1081f0eb52b5940572ccbf7df42

Download Submit
C:\Users\Admin\AppData\Local\Temp\provide.pptm

Filesize
19KB

MD5
fa222b214bc7d79c0a5cf4144e74ddf9

SHA1
96b5cba5cb17c5704633d93e810571d6fa716a41

SHA256
7c1eff74bfde780cc0e849d8f0157548170a66b31868a988e35a32c0e19e7107

SHA512
bc02ad2cd70bd9bb68ceefdeacd2d505d35aeedda1027701a83f1505f727c2831b7b5352db365104177ed900385356af5cb93623d81cf9746065fdebb426fcfb

Download Submit
C:\Users\Admin\Downloads\R---3----L-.zip

Filesize
24.0MB

MD5
cbebd71338a259cf6b2759c51bfcac2c

SHA1
16bc1d376a60a6ea5f76df9e28c13251c7afd9ad

SHA256
4e47125474d6bfc907663982e5837435179acd5e068ae59597b7d5cf3cd28d72

SHA512
eec9124c93ba7a8d7323b9335ef41ceed9ace6958b21d745bc3cf4c36e9d41347cb47576a3036594b8256978efdeea167fa9ee41c8135bc4b784832210ed2343

Download Submit
C:\Users\Admin\Downloads\R---3----L-.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1744-482-0x00007FF839B40000-0x00007FF839D49000-memory.dmp

Filesize
2.0MB

Download
memory/1744-484-0x0000000075B50000-0x0000000075DA2000-memory.dmp

Filesize
2.3MB

Download
memory/1744-481-0x0000000001440000-0x0000000001840000-memory.dmp

Filesize
4.0MB

Download
memory/1744-479-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/3392-504-0x0000000004D00000-0x0000000005100000-memory.dmp

Filesize
4.0MB

Download
memory/3392-507-0x0000000075B50000-0x0000000075DA2000-memory.dmp

Filesize
2.3MB

Download
memory/3392-505-0x00007FF839B40000-0x00007FF839D49000-memory.dmp

Filesize
2.0MB

Download
memory/3440-511-0x00007FF839B40000-0x00007FF839D49000-memory.dmp

Filesize
2.0MB

Download
memory/3440-513-0x0000000075B50000-0x0000000075DA2000-memory.dmp

Filesize
2.3MB

Download
memory/3440-508-0x0000000000840000-0x000000000084A000-memory.dmp

Filesize
40KB

Download
memory/3440-510-0x0000000001000000-0x0000000001400000-memory.dmp

Filesize
4.0MB

Download
memory/4660-476-0x00007FF839B40000-0x00007FF839D49000-memory.dmp

Filesize
2.0MB

Download
memory/4660-472-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download
memory/4660-470-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download
memory/4660-467-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download
memory/4660-471-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download
memory/4660-474-0x0000000004420000-0x0000000004820000-memory.dmp

Filesize
4.0MB

Download
memory/4660-478-0x0000000075B50000-0x0000000075DA2000-memory.dmp

Filesize
2.3MB

Download
memory/4660-468-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download
memory/4660-475-0x0000000004420000-0x0000000004820000-memory.dmp

Filesize
4.0MB

Download
memory/4660-466-0x0000000004390000-0x0000000004411000-memory.dmp

Filesize
516KB

Download