rhadamanthys | 143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8

Analysis

max time kernel
297s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2025, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Deushack.exe
Size

35.9MB
MD5

5c968b2507b72eb3c15b11eac7f8e852
SHA1

9d88d858047f2e6153c7b7c4dbb9bf0674ec6929
SHA256

143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8
SHA512

69282d30afcadb5e9e3d57e59a84bdabfd0a9988e97a9dd674a857f5d3f8035af084f0b62d0cf8d6c6c0bfaccbb9a554dc994e7990f2d4b676a88dfdbf9c1c2b
SSDEEP

393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvNqFTrYa

Score

10^/10

rhadamanthys defense_evasion discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral1/memory/3392-26-0x0000000000400000-0x0000000000522000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3392 created 2664	3392	MSBuild.exe	44

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	5916	Discord.exe

Executes dropped EXE 2 IoCs

pid	Process
5916	Discord.exe
3636	6YVZSGPG.exe

Loads dropped DLL 1 IoCs

pid	Process
3544	msedge.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3636 set thread context of 3392	3636	6YVZSGPG.exe	101

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-cy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-gl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-da.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1124899431\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-cs.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-ml.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-nb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-fr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-bg.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-de-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-en-us.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-sk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_915868576\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1124899431\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-ga.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-nl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_2071862857\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-lv.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1806689405\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1806689405\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-hu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-kn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_915868576\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-el.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_2071862857\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-af.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-nn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_915868576\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_2071862857\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1806689405\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-be.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-hi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-pt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-cu.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-it.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891351902834769"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3630502724-2561614198-3854231964-1000\{DABFC03E-5EF9-43C4-9FC0-F54CA7201FE8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1484	powershell.exe
1484	powershell.exe
3392	MSBuild.exe
3392	MSBuild.exe
3392	MSBuild.exe
3392	MSBuild.exe
2140	fontdrvhost.exe
2140	fontdrvhost.exe
2140	fontdrvhost.exe
2140	fontdrvhost.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5916	Discord.exe
Token: SeDebugPrivilege	1484	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 4916	5284	Deushack.exe	93
PID 5284 wrote to memory of 4916	5284	Deushack.exe	93
PID 4916 wrote to memory of 5916	4916	cmd.exe	94
PID 4916 wrote to memory of 5916	4916	cmd.exe	94
PID 5916 wrote to memory of 1484	5916	Discord.exe	96
PID 5916 wrote to memory of 1484	5916	Discord.exe	96
PID 5916 wrote to memory of 5984	5916	Discord.exe	98
PID 5916 wrote to memory of 5984	5916	Discord.exe	98
PID 5984 wrote to memory of 3636	5984	cmd.exe	100
PID 5984 wrote to memory of 3636	5984	cmd.exe	100
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3636 wrote to memory of 3392	3636	6YVZSGPG.exe	101
PID 3392 wrote to memory of 2140	3392	MSBuild.exe	102
PID 3392 wrote to memory of 2140	3392	MSBuild.exe	102
PID 3392 wrote to memory of 2140	3392	MSBuild.exe	102
PID 3392 wrote to memory of 2140	3392	MSBuild.exe	102
PID 3392 wrote to memory of 2140	3392	MSBuild.exe	102
PID 5284 wrote to memory of 1988	5284	Deushack.exe	103
PID 5284 wrote to memory of 1988	5284	Deushack.exe	103
PID 1988 wrote to memory of 3628	1988	cmd.exe	104
PID 1988 wrote to memory of 3628	1988	cmd.exe	104
PID 3628 wrote to memory of 3544	3628	msedge.exe	107
PID 3628 wrote to memory of 3544	3628	msedge.exe	107
PID 3544 wrote to memory of 4092	3544	msedge.exe	108
PID 3544 wrote to memory of 4092	3544	msedge.exe	108
PID 3544 wrote to memory of 1836	3544	msedge.exe	109
PID 3544 wrote to memory of 1836	3544	msedge.exe	109
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110
PID 3544 wrote to memory of 5008	3544	msedge.exe	110

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2664
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Users\Admin\AppData\Local\Temp\Deushack.exe
"C:\Users\Admin\AppData\Local\Temp\Deushack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFMAeQBzAHQAZQBtAEwAbwBnAHMAJwA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1484
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\SystemLogs\6YVZSGPG.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5984
    - - C:\Users\Admin\AppData\Local\SystemLogs\6YVZSGPG.exe
        
        "C:\Users\Admin\AppData\Local\SystemLogs\6YVZSGPG.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3636
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start https://t.me/DeusWinbot"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/DeusWinbot
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://t.me/DeusWinbot
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7fff3074f208,0x7fff3074f214,0x7fff3074f220
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        5⤵
        
        PID:1836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
        5⤵
        
        PID:392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3416,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        5⤵
        
        PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4556,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
        5⤵
        
        PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3548,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3616,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5476,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
        5⤵
        
        PID:2752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
        5⤵
        
        PID:116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=560,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
        5⤵
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6064,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
        5⤵
        
        PID:2324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5188,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
        5⤵
        
        PID:5144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3540,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
        5⤵
        
        PID:532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3580,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5572,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
        5⤵
        
        PID:1388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4544,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5272,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6100,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
        5⤵
        
        PID:852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4692,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:8
        5⤵
        
        PID:4800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5896,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3396,i,2999403218931090467,16997705206090656852,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:8
        5⤵
        
        PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1124899431\manifest.json

Filesize
118B

MD5
e17033475c5d0632b8142e61eb70b2db

SHA1
fcb918489b441cb2b3239bd1fd582dc0fb55d939

SHA256
0f4cbee2aac3714f6be3ada73202950f897f18c1cec7e23cf29931502d1c1e98

SHA512
7a458be534f73d273f8c2be6258f4829e9c6924e9c58a51ef60a27989223085bda87d52e36e2a5fa9bfe58e54dbec3c245ad456ae232548ad1e6dc23a8f2570d

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1203518026\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1322255505\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1368520425\manifest.json

Filesize
102B

MD5
a64e2a4236e705215a3fd5cb2697a71f

SHA1
1c73e6aad8f44ade36df31a23eaaf8cd0cae826d

SHA256
014e9fc1219beefc428ec749633125c9bff7febc3be73a14a8f18a6691cd2846

SHA512
75b30c0c8cef490aaf923afbdb5385d4770de82e698f71f8f126a6af5ef16f3a90d0c27687f405274177b1a5250436efddd228a6d2949651f43bd926e8a1cc99

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_1806689405\manifest.json

Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_2071862857\manifest.json

Filesize
141B

MD5
811f0436837c701dc1cea3d6292b3922

SHA1
4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87

SHA256
dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d

SHA512
21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_632221977\manifest.json

Filesize
116B

MD5
d20acf8558cf23f01769cf4aa61237e0

SHA1
c4b21384309b0ff177d9cd3aa4198ab327eb2993

SHA256
3493b321a7fc5e183ed6f223ae55ce962541717d0b332d16bdc7cbcadf7e6f78

SHA512
73d082cbd71f6d0f06c7afc1bf63ee41c9a8e501df3e56f21a551b2d369a0afc8306894c8e0a38d0324e2ac403ec506ac1ecd8e9b61a9cb27134a229ccb13725

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3544_915868576\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0ab27b557c982a0966e0e873ec0af684

SHA1
91cad3834539c09bbdaaa04843abc5540e7b9215

SHA256
0520ac04b1bd66dcdebc58825ac17be618be85ddd4e16ede2f0fa4bcbe46fc40

SHA512
3a492cd3500644fbdee6a1595add1e1bfbe64ce606a461361be8d7d65f91ff74dd4b3c1e5fbf22dc9531c9da66452545d0bdb2b9b464f0802f0964e2cf6bf0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
352B

MD5
db91063cb1425a277a91b97cf07d75df

SHA1
b6af3e390e4469d06c298e38649950e9ad76d681

SHA256
d6324e48b38797d5337809dbfc67cd36bc36676332e26cdf66cd282b85adfcd3

SHA512
a78cb0ae102d918ce336f6538b73f6e1714f483b6a7623b119bebe999e5c342642ab0f4b1b29066570a5ac3205da0e32e3d66754eb0ca1d485c65e64cb8ab122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
268B

MD5
37c41d819bba9df47322da0e7bdf3db3

SHA1
c9c27e52126d8f45da0c5ed4de082f6ebffb6550

SHA256
f9750c68d5d132ea910e92223d154ed8f151112fa49a821ba426b860e6b64969

SHA512
412c0f31ef3bc48e222f01a41aa7385990c53fff78eeb9126d55ddf61d1846a6986a9deb564ed838663c1b16d8448bebf35723aefca06a93000a2e224c529d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3023b4cc21c2d7ce55d0c462408f24de

SHA1
fd33f0e1dc6968c8b0be654ab393c14364888f35

SHA256
34f335d9abcb6f0a406d885963df33b763f01e77d03461b071ea4e867db84beb

SHA512
f6dbf05742a28e9a4c1535342a03a8261eede815ce29d37026d73531a49fc4d5faae14c4c7f722e6481b67b2522473eeb4ff1e696b937586cee73a801485a054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58173c.TMP

Filesize
3KB

MD5
2fef54c83f04c9d6c194450b2e4fa7a9

SHA1
d07895c38bb65624ce1ccd1f984e63d4b1d7080d

SHA256
1ecf5212895933c539db4f64daac3871e71da1a2a479fa27b4cef57f03b79590

SHA512
25132a13ab3f1e8b5dec53cf706c963ecc6b1579a1eda501ec14b30342d5d6903891f48b6fb7f48fea67cfd2386234ce419eb735099c59b4cd59117c22552f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f8c5141a0331c3b69a866925a258256e

SHA1
864ba3e939186a195f0e8258915228aa82b8848e

SHA256
893147ff2ef5f5b171c9ec8a56bdf136c0e0b1cf9644f5e4d69c087f26952ca0

SHA512
83119a59f6e8be7de0b8178f8a673ed5cd19036aaffef90b40f0a22bc4652815b6e35e984219b1190b3e745649e256cc9eb3bc085fc315daf316de3a7aa833d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
948ac1ff35e555598feee31adeddcdfa

SHA1
11b96b59ed56cee083305a1e25fb3a39e12ed259

SHA256
7e0690736b60b42fa10a46103c0c2e4238cd8c35fe2b275052589459a4ecfef2

SHA512
604807bca2595ca7f5147fb257dc6111eb145c0c6e2d8861df98b83fd6bc53e17f10d95ebb88b93457db64f3e387c7b668c3ad08c8b01f272a82ecf092fd6472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
e9ea59cf0cfb819744f41a6491ad188a

SHA1
440032501beab0b4b58c37c6eb766aa44a61270a

SHA256
73e0bb1dfa09ee5ab9c969f02cd5f0514bf05107f8e51f02982be2efe3ba7e41

SHA512
e95148cff9d3fdb9841ebde7bbd1db7c0a06f2d99b9c64f3fbd59a6ea066e001a4b5bfb5e147568c06097493f523e2f75893b4de672acc91baa43843301ca565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
dbb5efa52f2983cf34547474379a5798

SHA1
933822e8f621941a4e7035a0e1092a592e09e3d8

SHA256
60ba973258fe3d57c241512d3974fd768f3c65d8a54211f669677f8dd3f87794

SHA512
16573636a56bd0cb66d59f330d141039220a0583bc6aad6d7f1cc248779fd81455d09b90c326775051d9026856d2a81d6456244a2b3e61687e61d7539f11c296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
aefdf8d1360e2c79573d0677f295395c

SHA1
b565a56d7ac0b72488b621f9513c9cb00aa5385f

SHA256
512823852484faf7fc014e12c6902b9c6ade9939290ea204232f14174054f265

SHA512
88dd1e7f18b5d2c15418bb53658a5f635c5401da836709b50217231bb8d24dd3d5a09b625249825aebbe563c81434a8accb6a912692701a32ea4a92e8ee2aae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
21KB

MD5
306883f0e46607f3d55c2569b1d20386

SHA1
3be7e51cd35c170b809738e6c633a54e2f25e175

SHA256
06c9415d17916a9cafa673a7026cdbb755d2851aa86cccad46c17a721296dfe5

SHA512
cc95a3bcc90771a8c512a113d0b701b6b7cacbe627424360d2fb0d0035192cdaf066bef70a58da006206f231e781d43cef3d66a0797f7574bbf838cfb189ed6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
e2c8174d35e117a32fc4e8e4357c24fd

SHA1
3951de6f91d11d02f8b1f57a63bee8b11602100a

SHA256
e2a1f113e4f3264d8108924fc708d63e06ec69aaa297d92fde0d1f338f6e2ff9

SHA512
5561f7bec0cd9ece22e8a6af02e78de4ffbd213476db97e2aa3d32d7f208cd596da1566d8f80878b2369d2551f89222eaf6d18fca199b9605ea54041d90d6565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
e17bb9de83a924823f394e13b0170093

SHA1
7d6570440be1eb40721f755f03d2f5cb0360b316

SHA256
842232c220fa75148d215a90f9bde0bf2c2e050e194172f0ac980568109b2a71

SHA512
a298e388e905bf822bbbeb5362f6c5a3c6a5216618a9655032be2f5c78c3f479f1512aaae021d9397175c4e56904814bd78d0446465c12a0075f9dcf77511067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a94e8133-dc4c-4448-a01c-2c9b36d199f4.tmp

Filesize
900B

MD5
59a7432598ee8e0c068808291ef12b2f

SHA1
0e1944aa5f6eaad7acbc4f8b79d9edaa4c8bd1a2

SHA256
860227d0c1581e2a16b568e061f76bb090089fa9502d4f47d17539aeee119170

SHA512
dd0c8e7273680408707c38ae8c4ed53f7c739aa1454ea2af9a7e20a2f7f4d8d30a10d039ab560315088225718f8d42cc38d18b7d7d2ce1ab625ad5f5e6d8753a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
c864570da9c7cdef06fc2991bafd7380

SHA1
0149beaf15e7bc07276e52639f1fd85450056a4c

SHA256
7954a0d8aca6903d083067746da3433cb2df9588e133165adcadaabe2c10f471

SHA512
bf17ae0a3728cfda3f21cd892f4bdbe209bf5881b9f973b8b4864417b8c6885d25e6600d083d19bbd1d4699a3ebd73328b8e801c68f4d32b058d4864895172ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
bc4de8b4a480a505500bdfd7b582a2fb

SHA1
c36d6ad371f9395556b0e9c6993c3af3f70f4972

SHA256
3ced1ce91c7a1879332871cce16611436daeca1981a0df29ced134d72def8970

SHA512
e6e998ddf75b2ba169fbead373adb3021bbd3bb4cdb25da8592d0623120dd49b3555d02fc183d798cf7992bde72a3223856b0cb23ecd3555ec95c97347fa6fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
8d4a9478e3ac7ecbfe3288a6d64347ea

SHA1
faf0181d394f720f054fcc15e2efeeb5606083a1

SHA256
8f30aca95fff2b6852e32c59e2a5034a405fa94f67148300f888da8418f85cbe

SHA512
a2a2c5c9ad667e1266a269b328f89334ff253790b21bedcc134fd2b0373a0d078fd1f9ca7e5a2c8ba1ccd3cd7fcadfca0f94e471b6c800e504aac4a7f9c354f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
e5e80a249a16d00e75c45b483c8777de

SHA1
0d7c09ce862faf94d9709d3580cefced26adcac5

SHA256
5d6dcc560c07d9c5219b0ade4d1ec44758699cec28f2eabe38a1051543fbc0c3

SHA512
4321a3289fbab053034a911d648d3da06e3716ce6825f8f21f9021b5e1ce10363dc51eae2135e795a8029da3ce3c79c876ae707a30a1f563d278efdf6f62bc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\crs.pb

Filesize
289KB

MD5
2b59269e7efdd95ba14eeb780dfb98c2

SHA1
b3f84cbc37a79eeecb8f1f39b615577d78600096

SHA256
ff2ced650772249abb57f6f19c5d0322d6df22c85c7cf2be193b6134e1b95172

SHA512
e4b454db2248021e0d198805ea54f1c0cfd84b9716a9348b1d0e0acb7c6fb5dd0839e532a5eb6d4410ab759d6688dd6cce8375ad55a150d738d280993142e9d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\ct_config.pb

Filesize
8KB

MD5
811b65320a82ebd6686fabf4bb1cb81a

SHA1
c660d448114043babec5d1c9c2584df6fab7f69b

SHA256
52687dd0c06f86a2298a4442ab8afa9b608271ec01a67217d7b58dab7e507bdf

SHA512
33350cce447508269b7714d9e551560553e020d6acf37a6a6021dc497d4008ce9e532dd615ad68872d75da22ac2039ef0b4fa70c23ec4b58043c468d5d75fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\22.0.0.0\kp_pinslist.pb

Filesize
11KB

MD5
0779206f78d8b0d540445a10cb51670c

SHA1
67f0f916be73bf5cffd3f4c4aa8d122c7d73ad54

SHA256
bf0945921058b9e67db61e6a559531af2f9b78d5fbedb0b411384225bdd366ec

SHA512
4140b2debe9c0b04e1e59be1387dca0e8e2f3cbc1f67830cbc723864acc2276cde9529295dcb4138fa0e2e116416658753fe46901dfa572bdfe6c7fb67bd8478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.14.1\typosquatting_list.pb

Filesize
626KB

MD5
cd8f0547b4d0459fc40caa32edd2ae48

SHA1
f2a2267b07c94eee76441654294d4bee793913fa

SHA256
b7ced53d106f852e82076b850fe7794ddeaeaf137818339b95a35ffc170277a7

SHA512
0f1790dd996e27dbbf75a6520279941dcdd002429595e02646ceddae317f87fe34ca01049735ed753904ceccc1ecc24080e22c34ba6343ebb155c8e7a89085d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

Filesize
572KB

MD5
f5f5b37fd514776f455864502c852773

SHA1
8d5ed434173fd77feb33cb6cb0fad5e2388d97c6

SHA256
2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e

SHA512
b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
6ae41c92ee4c4303b848c21fc9288159

SHA1
c78efe8bf22826ad715e171daaefe67ebcc7d210

SHA256
b91de065d230ed7c4d289169873e2a5a8c62fd7d686f554dbd24224ddbfe78a9

SHA512
4c3fd53c8c6fe13aaa19401041459776394961feaa555931af6ecbdd15e99023773f164c9cfd7e3f9b7993aa0f626744284cc24c08165000727ab347dc2b6af4

Download Submit
C:\Users\Admin\AppData\Local\SystemLogs\6YVZSGPG.exe

Filesize
3.2MB

MD5
989a61c1043f1267095a8bb396500830

SHA1
235d3eb42c6c66d71777d927a42ba4db33c205a4

SHA256
bfe8a764e4c82d2cb74a80df209069295fb85b2e458eee2ea3b2bf8da55bb363

SHA512
491275f8f5c76a0a9793265b9b8fbb591058920e3c9936396677dd4215dcadd8a594fd4f428991371a768a97270d04c633e46d6e82bfed5623caa7f9cf65c6d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe

Filesize
7KB

MD5
a46b45489799bdc265a0d66c1bbaa374

SHA1
58bdd58c9fa884da0ce7e469f41d20e338175083

SHA256
88fce138c5a8010178facb5b724c198c8d7e539d9a9e60a949fcff9df82c4743

SHA512
97abb207c41f6172ce45dcba0f18914fdda7af35740cbc369a2f9d3c0fbfdb6561542bcac6c83316ee881d09239f61d1b68d7f6fb67d7ca0b3cc4fa460689dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1frtemnf.mjz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1484-9-0x0000019031FF0000-0x0000019032012000-memory.dmp

Filesize
136KB

Download
memory/2140-37-0x0000000000A70000-0x0000000000E70000-memory.dmp

Filesize
4.0MB

Download
memory/2140-34-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/2140-38-0x00007FFF4E830000-0x00007FFF4EA25000-memory.dmp

Filesize
2.0MB

Download
memory/2140-40-0x0000000075A70000-0x0000000075C85000-memory.dmp

Filesize
2.1MB

Download
memory/3392-29-0x0000000005060000-0x0000000005460000-memory.dmp

Filesize
4.0MB

Download
memory/3392-26-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/3392-27-0x0000000004E90000-0x0000000004E98000-memory.dmp

Filesize
32KB

Download
memory/3392-28-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3392-30-0x0000000005060000-0x0000000005460000-memory.dmp

Filesize
4.0MB

Download
memory/3392-31-0x00007FFF4E830000-0x00007FFF4EA25000-memory.dmp

Filesize
2.0MB

Download
memory/3392-33-0x0000000075A70000-0x0000000075C85000-memory.dmp

Filesize
2.1MB

Download
memory/5916-22-0x00007FFF2FCC0000-0x00007FFF30781000-memory.dmp

Filesize
10.8MB

Download
memory/5916-7-0x00007FFF2FCC0000-0x00007FFF30781000-memory.dmp

Filesize
10.8MB

Download
memory/5916-6-0x0000020F1A6B0000-0x0000020F1A6B8000-memory.dmp

Filesize
32KB

Download
memory/5916-5-0x00007FFF2FCC3000-0x00007FFF2FCC5000-memory.dmp

Filesize
8KB

Download