rhadamanthys | 143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8

Analysis

max time kernel
287s
max time network
287s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
14/04/2025, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Deushack.exe
Size

35.9MB
MD5

5c968b2507b72eb3c15b11eac7f8e852
SHA1

9d88d858047f2e6153c7b7c4dbb9bf0674ec6929
SHA256

143a401d4b53578aaa517cefbf94997c9862c58b87de79eb2d00b203cbbf7ad8
SHA512

69282d30afcadb5e9e3d57e59a84bdabfd0a9988e97a9dd674a857f5d3f8035af084f0b62d0cf8d6c6c0bfaccbb9a554dc994e7990f2d4b676a88dfdbf9c1c2b
SSDEEP

393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvNqFTrYa

Score

10^/10

rhadamanthys defense_evasion discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 1 IoCs

resource	yara_rule
behavioral3/memory/4460-25-0x0000000000400000-0x0000000000522000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4460 created 2888	4460	MSBuild.exe	49

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	2128	Discord.exe

Executes dropped EXE 2 IoCs

pid	Process
2128	Discord.exe
4456	UKUEKL8V.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 4460	4456	UKUEKL8V.exe	86

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1524527400\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1524527400\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1578145315\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1514755483\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-mobile-hub\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1524527400\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-shared-components\hu\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891352183869724"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144164418-4152157973-2926181071-1000\{F573F840-A28B-4E70-89ED-435E5C9B5817}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2372	powershell.exe
2372	powershell.exe
4460	MSBuild.exe
4460	MSBuild.exe
4460	MSBuild.exe
4460	MSBuild.exe
4352	svchost.exe
4352	svchost.exe
4352	svchost.exe
4352	svchost.exe
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	Discord.exe
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2744	4772	Deushack.exe	79
PID 4772 wrote to memory of 2744	4772	Deushack.exe	79
PID 2744 wrote to memory of 2128	2744	cmd.exe	80
PID 2744 wrote to memory of 2128	2744	cmd.exe	80
PID 2128 wrote to memory of 2372	2128	Discord.exe	81
PID 2128 wrote to memory of 2372	2128	Discord.exe	81
PID 2128 wrote to memory of 4968	2128	Discord.exe	83
PID 2128 wrote to memory of 4968	2128	Discord.exe	83
PID 4968 wrote to memory of 4456	4968	cmd.exe	85
PID 4968 wrote to memory of 4456	4968	cmd.exe	85
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4456 wrote to memory of 4460	4456	UKUEKL8V.exe	86
PID 4460 wrote to memory of 4352	4460	MSBuild.exe	87
PID 4460 wrote to memory of 4352	4460	MSBuild.exe	87
PID 4460 wrote to memory of 4352	4460	MSBuild.exe	87
PID 4460 wrote to memory of 4352	4460	MSBuild.exe	87
PID 4460 wrote to memory of 4352	4460	MSBuild.exe	87
PID 4772 wrote to memory of 4200	4772	Deushack.exe	88
PID 4772 wrote to memory of 4200	4772	Deushack.exe	88
PID 4200 wrote to memory of 5096	4200	cmd.exe	89
PID 4200 wrote to memory of 5096	4200	cmd.exe	89
PID 5096 wrote to memory of 2224	5096	msedge.exe	92
PID 5096 wrote to memory of 2224	5096	msedge.exe	92
PID 5096 wrote to memory of 3820	5096	msedge.exe	93
PID 5096 wrote to memory of 3820	5096	msedge.exe	93
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94
PID 5096 wrote to memory of 4336	5096	msedge.exe	94

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2888
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Users\Admin\AppData\Local\Temp\Deushack.exe
"C:\Users\Admin\AppData\Local\Temp\Deushack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start "" "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFMAeQBzAHQAZQBtAEwAbwBnAHMAJwA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2372
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\SystemLogs\UKUEKL8V.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Users\Admin\AppData\Local\SystemLogs\UKUEKL8V.exe
        
        "C:\Users\Admin\AppData\Local\SystemLogs\UKUEKL8V.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4456
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "start https://t.me/DeusWinbot"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/DeusWinbot
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x35c,0x7ff9f4c8f208,0x7ff9f4c8f214,0x7ff9f4c8f220
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1872,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:13
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3404,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4840,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3516,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5564,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5712,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5800,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3600,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5960,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5136,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1164,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,3207591193260031224,15814716790492987358,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
9e4597d6e9951c90f605fa4a330843b2

SHA1
c9a4c72aba3b9584e03d0db43aee91e51094c369

SHA256
272d838982199dc905b6eea7f57fc331c216efacab7d865cf427fa4972aff009

SHA512
adbf3948d11ce019ee5a0e8971b7b08567c7a3de742e03274ae0bd868f64f4d09e93e91e38681b34eb017af7d4708e5484b776b9b3828715d05f35621423fe05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
268B

MD5
f7afca6684899f33e99d431cd80d39c2

SHA1
aecf1635298c845584f9a161297f0083f2daf34a

SHA256
a925945ab1a8fb2584c4b9c42cd584c408840d6641e200609c6cb38725e70f2f

SHA512
d244b058de793ead5a3f6285e7b70b7efe99346ad33dc5a51bb47df4a05061265a9cd687eaefe1a2a2827fe5087b4e2de4dc070e5f6666232c52d939f66878e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d5ea8245f1adee9315ba21ffeb84575f

SHA1
57017ce99f80ba7452bb1f11dd32d495e042b09b

SHA256
7ab3326b9494a7a4df65d38d336c55cf53382f02e9268d2bcb11bc8be041f08d

SHA512
c7ed5314da6c5d2e9af5b7879defcab9bcb98ce5068b16ecdbfbaa49ad5e9379795d983efe24b79f6a57b46fd798055d22b1a43f066b54289a31846b316ff62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58652d.TMP

Filesize
3KB

MD5
52a99ac88cea6095d1c8111e1ee55279

SHA1
701a37dc119b1cf7b6b02a4159f367d9e0476152

SHA256
28c86644613e70427eecd5317bc6677cbaa73914f42398a83f703007ea94c794

SHA512
1711b853ef1edc649bce951bb3c7bcfacd8d09f5ca0663712d2dbc53aa5ce99d8d4d6693537a6c198870bd54db6a3d14be04c21a3c49b03cefaef7921d4a46b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6fd3380a23a402c649c7cfebda621792

SHA1
fd0321593ad400841783d5a69388dd2c022684b4

SHA256
738a4bfa98dbd796ce38c62a3660a66850e7802ef01d19f37eb50be0daf05f9f

SHA512
0975a97e02a020830fbcbb97559f7446034e45adbdd8ade40f5636e399be070839287ed05cb6190adafad833ab8f0d7c8e29266f3b83a0ff6f30b84b79df2657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
67ab82b2bc1ec3a5b0bf05f353586bed

SHA1
310db1c960474d76c012b8334b20447ddeec0238

SHA256
aa9e7bb79782011397e907be78257409ed7fc30cff7ad25fc8499d84f1858f6b

SHA512
cc0ff551ffda9dff1b325941d1b747e401d7fb75298af2168aa17ef3923b5b8a9f1315364eb0c80d74a85ce64eaf38ad6f00adac2575d9da129e1b674c6cc9c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
c1844991501cfd0e7581bb919cfff4aa

SHA1
d6124b62bdc247128e192afb38f2550c80d4db14

SHA256
90d037f723306fec83e2401974e8ca8bd2bf95d0bb9aaa73d1c3503aedffd733

SHA512
6bc6860b7484b7cb22d9aaa96a767fba6160c6e33efaeec5d2e181f905cfcf21cd0ea838582b6ae655af1efe1fb09b6afba18286e430c06cc34fd21aedc68b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3c38a90d8dffe11eb0942bebd2cecc1a

SHA1
c33a19fbd3c0cf5e0e5b148c86cebf382b449d42

SHA256
efb83bf47455879041c8591a2a5c2c348a144c75b243b75e0158f1f0f5cd8b1f

SHA512
af447808be539af2cec900fda35f8363843f66c7449f994206df9f18ceab46db9008709f2feb568672aacff671bb0f3136b72baf5559d4290c3db9b991942d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
c4ba53de51a82570aa4aff3192208815

SHA1
942ebca87d8a2c6aa22eabe85e298ba14c8f2ec6

SHA256
b08895bc7e45658505cab39053b9f80feb9f7f8f6b6c74a19a89b261a2477518

SHA512
9aa0c1e658ef1af124e2276d0f3e4787065c08dd46598ef6be1f4333b95f8b5d4544413425d6ecb5d385f4db907f69b42c3bb1e8595baaa01080efd85008d716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
ba7823d8ccf0977d8f1b16a36fe2021a

SHA1
a3cd4fcdbbad0fc7f2995aa4ec2aa9221bab5aec

SHA256
c60f1d0e3e9131d85d8154a30a74f241efcd8a7bb374eb604e368dc20ecb5ef8

SHA512
5a540dd38bb457a16ee4ea9a5e8af4bb240b4bcf4efb3e7566e101a14e3579ca075f66194886db84302bfd4b8c912de3315976830f7be5f4e1ba183af6d0a1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
cab6a45f02ae1095896237f1fe39dee7

SHA1
88563e281e3208b034966a511b644f79c40737df

SHA256
cbc7a9ded2a5e5b52236ca6d6327d12052d5b82d9e2fa4a5ec1cbbf07fc7c2b9

SHA512
0c88eee4fd3c4a09fffa43cd8930da4841ab73f55e49260ce8ba0c7b4b91818729c6fe74e15ff14b900e001e21ed3fffbdc49cde4218a71d90577e6fb4acf9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
914182ce723e8426f91fd12151077844

SHA1
fd6dfd6152578a209d2cb015822ad206c3ff3632

SHA256
a9d64929402c88787853adfbe5ea15c435530205ad49c08161b5368511e124bb

SHA512
79c1ce6b83707d83597259eaa0ded01e81c14d7e85420cb2eb93d854d4332d7d5e7093320a68b5632a8117add65407c534c7790f2adb54d87f86bfae537c24c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
31161080f18e21042eeb04a66fbc0ab9

SHA1
4ffa41b3a29e973f52b3e2cb63be991662535d7e

SHA256
06b8d85a11fa9d57ec87aadb19121f039784d03997ba10a6d0c92ed666a01d8a

SHA512
6bfd0a698ee18915f5fa0b1d1a245e849b05dea89352b7386f61650edc8857b3b983fc33eab7230bde6f469b0945f7e944b18516a06e715de49bb1ce8dcb4154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.37.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
003fe9be736ed918d1fa5738e03dee2a

SHA1
1875f50d89bfa23064db1a7c2d80f97e3f4fa1e3

SHA256
3bb1b93f917e9d8e76afa18c3f6d88bd7708b26f5142b29b8e977af80e93d8af

SHA512
e6af65d2586da8a96014faeb9ce5986aeecb04145f66b32be0d2cf849d6e56c22c179ac8adb9211e7ab7cc41d9d8e0a8f7910210b8adfd810f13f43563c4c5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-stable.json

Filesize
81KB

MD5
05f65948a88bd669597fc3b4e225ecae

SHA1
5397b14065e49ff908c66c51fc09f53fff7caed7

SHA256
0e329e63d8457bef61d0986a521f81d747a09dadf3b1136f2011942ba14d9fc0

SHA512
ed7b767a741d18c0dd35e0311db752120e0f090d39ef976d541cbc5ae78fa32655cb3f9c27cddef6ca8091ca8bf31513254a748bc8b95353897f6198a667cf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18347.18346.65\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
742e957b9a4afae3c355dd3d616fedae

SHA1
7918ac139bf9307cd42f1a2b487c636e023fd73f

SHA256
d414e05d27d2b6e54dfcea087d67d29058c413a2550eea97e26809116543cdbe

SHA512
6b148b09684d995dffabd284308bee92096c472e819d00524e886449061bd306ee58328dbd3f5569e85df1b17f8eb333e11c66ee08b0e69fb2aaef2a27f919bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a3faa82effce0a16741cc55ad24a4612

SHA1
3adf0a348375c215e5541f02cb0f472dd6e19361

SHA256
e281caa8fbec56cdafc6b36180f609b99d288c515ded21e915726be4f59c8fe4

SHA512
a5204504bf18730bb91b29b4d6c9ff797db753cb88458e9a028e06c44426262c07f9885f590ce8dd2db1f12aeb05d8d3bcb1792ab6086e4ef16a0ce49b460d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
3bfd95c57535c92e066ca87d74a33402

SHA1
a14d2566d9d4c8f4194ea5045a71ff8d2fe9cb70

SHA256
e72614252dac9199df787372f5499ddf9709cb8da0c68c154d5435bd77bc1f9d

SHA512
525be2438fde24415498ea479d45290a1481a00c384acfc4246232122d9c78ce043c441fc57e976cfb4c94c22ba91af87207f6b7fff8fb2fc0f465d561527b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.76\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.14.1\typosquatting_list.pb

Filesize
626KB

MD5
cd8f0547b4d0459fc40caa32edd2ae48

SHA1
f2a2267b07c94eee76441654294d4bee793913fa

SHA256
b7ced53d106f852e82076b850fe7794ddeaeaf137818339b95a35ffc170277a7

SHA512
0f1790dd996e27dbbf75a6520279941dcdd002429595e02646ceddae317f87fe34ca01049735ed753904ceccc1ecc24080e22c34ba6343ebb155c8e7a89085d8

Download Submit
C:\Users\Admin\AppData\Local\SystemLogs\UKUEKL8V.exe

Filesize
3.2MB

MD5
989a61c1043f1267095a8bb396500830

SHA1
235d3eb42c6c66d71777d927a42ba4db33c205a4

SHA256
bfe8a764e4c82d2cb74a80df209069295fb85b2e458eee2ea3b2bf8da55bb363

SHA512
491275f8f5c76a0a9793265b9b8fbb591058920e3c9936396677dd4215dcadd8a594fd4f428991371a768a97270d04c633e46d6e82bfed5623caa7f9cf65c6d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\UpdaterService\Discord.exe

Filesize
7KB

MD5
a46b45489799bdc265a0d66c1bbaa374

SHA1
58bdd58c9fa884da0ce7e469f41d20e338175083

SHA256
88fce138c5a8010178facb5b724c198c8d7e539d9a9e60a949fcff9df82c4743

SHA512
97abb207c41f6172ce45dcba0f18914fdda7af35740cbc369a2f9d3c0fbfdb6561542bcac6c83316ee881d09239f61d1b68d7f6fb67d7ca0b3cc4fa460689dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qcjl13ks.1hx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1317481085\manifest.json

Filesize
122B

MD5
0d77c27baa669b0714c49b73e68447ea

SHA1
65103c9707e083c5503ad9979560ba1bb7634ae4

SHA256
c853d6a286d9d31a382c6d3fb109d5336d275651950f22b8243289eb6125b516

SHA512
1f011c405ec558229a1f5e2923b38b7054144c66d4c69d658c9c2c371f6cc365317485c274cafcab80bcb88f989b0be4c43c763933de3f86362a79ec1e962ff3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1514755483\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1524527400\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1524527400\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1578145315\manifest.json

Filesize
118B

MD5
e17033475c5d0632b8142e61eb70b2db

SHA1
fcb918489b441cb2b3239bd1fd582dc0fb55d939

SHA256
0f4cbee2aac3714f6be3ada73202950f897f18c1cec7e23cf29931502d1c1e98

SHA512
7a458be534f73d273f8c2be6258f4829e9c6924e9c58a51ef60a27989223085bda87d52e36e2a5fa9bfe58e54dbec3c245ad456ae232548ad1e6dc23a8f2570d

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_1589396889\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_267346250\manifest.json

Filesize
145B

MD5
a3842aa29862631e5548a02b38a07ffa

SHA1
d4b345c8f29d091bf67df12a17b72df84ff1d24a

SHA256
86408cbb3cb0c03520762e8d59f5dfb8887d68219bef2ce95bb50b5486d6d5bc

SHA512
3f0171c91a973b0910538eca3f2802a8ec54f7b615a525206896f4feeba61332c40089db7b655d156e32a654480cad3ffafa7caa3c042cf6ba94619c0cc93cb8

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5096_908424489\manifest.json

Filesize
116B

MD5
d20acf8558cf23f01769cf4aa61237e0

SHA1
c4b21384309b0ff177d9cd3aa4198ab327eb2993

SHA256
3493b321a7fc5e183ed6f223ae55ce962541717d0b332d16bdc7cbcadf7e6f78

SHA512
73d082cbd71f6d0f06c7afc1bf63ee41c9a8e501df3e56f21a551b2d369a0afc8306894c8e0a38d0324e2ac403ec506ac1ecd8e9b61a9cb27134a229ccb13725

Download Submit
memory/2128-7-0x00007FF9E2FB0000-0x00007FF9E3A72000-memory.dmp

Filesize
10.8MB

Download
memory/2128-21-0x00007FF9E2FB0000-0x00007FF9E3A72000-memory.dmp

Filesize
10.8MB

Download
memory/2128-5-0x00007FF9E2FB3000-0x00007FF9E2FB5000-memory.dmp

Filesize
8KB

Download
memory/2128-6-0x0000028F316A0000-0x0000028F316A8000-memory.dmp

Filesize
32KB

Download
memory/2372-17-0x0000015A02680000-0x0000015A026A2000-memory.dmp

Filesize
136KB

Download
memory/4352-36-0x0000000000FA0000-0x00000000013A0000-memory.dmp

Filesize
4.0MB

Download
memory/4352-33-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/4352-39-0x0000000076C50000-0x0000000076EA2000-memory.dmp

Filesize
2.3MB

Download
memory/4352-37-0x00007FFA03EA0000-0x00007FFA040A9000-memory.dmp

Filesize
2.0MB

Download
memory/4460-29-0x0000000005500000-0x0000000005900000-memory.dmp

Filesize
4.0MB

Download
memory/4460-25-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4460-26-0x0000000002E00000-0x0000000002E08000-memory.dmp

Filesize
32KB

Download
memory/4460-27-0x0000000002E10000-0x0000000002E20000-memory.dmp

Filesize
64KB

Download
memory/4460-28-0x0000000005500000-0x0000000005900000-memory.dmp

Filesize
4.0MB

Download
memory/4460-30-0x00007FFA03EA0000-0x00007FFA040A9000-memory.dmp

Filesize
2.0MB

Download
memory/4460-32-0x0000000076C50000-0x0000000076EA2000-memory.dmp

Filesize
2.3MB

Download