8fedd0ca0e90c113950ca9fe3685c46bc51515ff68791ef26eb87dd4da965890

Resubmissions

19/04/2025, 22:20

250419-19hzksyjy2 10

19/04/2025, 22:16

250419-16282sv1fv 10

19/04/2025, 22:11

250419-1395gsv1ew 10

Analysis

max time kernel
299s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2025, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ColdRAT/ColdRAT.exe
Size

9.5MB
MD5

d1dd11a93098bdea72c1d6743d26ce8d
SHA1

38535678875626a2ee2f32a786e7e671fe19c579
SHA256

22cb65ecad3abf018473b6760958414740a009ead7b968cdc3ac889a38e0427a
SHA512

b1008af59d3df4a9645bd446afdeb77dfc53634b29f56b9fc37d82e90141d243e15468f7e2532859f9702701199fcd140126ef7541e5f65505f645a32a561bfd
SSDEEP

196608:VW6NA/0Lqz6Dc5i2cklYXrE1xTqL1WrJd4KT:YWW0q6A2QTqBgv

Score

5^/10

discovery execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2192	ColdRAT.exe
2192	ColdRAT.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1571631173\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1571631173\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1571631173\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5240	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133895750950731544"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ColdRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3582532709-2637047242-3508314386-1000\{13E9956F-E82A-41D5-A0DB-56582F055980}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ColdRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	ColdRAT.exe
Key created	\Registry\User\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\NotificationData	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ColdRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ColdRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ColdRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ColdRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3582532709-2637047242-3508314386-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	ColdRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5240	powershell.exe
5240	powershell.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3800	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	ColdRAT.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeDebugPrivilege	3800	taskmgr.exe
Token: SeSystemProfilePrivilege	3800	taskmgr.exe
Token: SeCreateGlobalPrivilege	3800	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe
3800	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	ColdRAT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 5240	2192	ColdRAT.exe	78
PID 2192 wrote to memory of 5240	2192	ColdRAT.exe	78
PID 2192 wrote to memory of 3260	2192	ColdRAT.exe	83
PID 2192 wrote to memory of 3260	2192	ColdRAT.exe	83
PID 3260 wrote to memory of 3120	3260	msedge.exe	84
PID 3260 wrote to memory of 3120	3260	msedge.exe	84
PID 3260 wrote to memory of 2036	3260	msedge.exe	85
PID 3260 wrote to memory of 2036	3260	msedge.exe	85
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 1492	3260	msedge.exe	86
PID 3260 wrote to memory of 5724	3260	msedge.exe	87
PID 3260 wrote to memory of 5724	3260	msedge.exe	87
PID 3260 wrote to memory of 5724	3260	msedge.exe	87
PID 3260 wrote to memory of 5724	3260	msedge.exe	87
PID 3260 wrote to memory of 5724	3260	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\ColdRAT\ColdRAT.exe
"C:\Users\Admin\AppData\Local\Temp\ColdRAT\ColdRAT.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $motherboard = (Get-WmiObject -Class Win32_BaseBoard).SerialNumber $cpu = (Get-WmiObject -Class Win32_Processor).ProcessorId Write-Output $motherboard Write-Output $cpu "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/ColdRATPurchaseBot
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ffcb2ccf208,0x7ffcb2ccf214,0x7ffcb2ccf220
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1940,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1984,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2468,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4756,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4800,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5008,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5656,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4816,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
    3⤵
    PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3544,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4936,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6208,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6224,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=908,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=904,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:10
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,14071930963878010480,2019741184693817847,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:5636

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
978d790ea9bbd3b3113b1d32773304fa

SHA1
61c9b3724e684c2a0507d7c9ae294e668e6c6e58

SHA256
36c686a276e904607d2a18c2a2fc54467fb8dc1698607f5d5a6cefb75aa513c8

SHA512
d50740255d20d2a5e6abdc78f4fe9ef6e832f2ffe9ecc200916a73db1e0dd37d67d88996b315e128bf5b77bb110e4e8c29905aa5d90b83019be2cc8127d0dfc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6c859f76275fec7e1d6a9403257f9384

SHA1
9473dee7703b4537a3a7296447485e251e33fa18

SHA256
fedaf493f5ee66336f3eebb725fc9a5e3c8c61db5ff0cc7b70c7f431077ac61d

SHA512
043370630219f67a0a8e643f4d87665a233ca6ce67d0f341c3a8152bdf94dbb0111925962f89d2f7f37d091bd5f7e5fe91fa09bc56de93f69229ba75bc071be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1157.TMP

Filesize
3KB

MD5
b89e17883e4c8ee587586756d38c8bbe

SHA1
b94e6ed4a3550b77d9b8668c64b287a611f57fb9

SHA256
0d860ce7d2fc1fe19685e82e4d7d968a2cf030843dcf3a7d6d91518898c7fcd6

SHA512
47aac222ba78accdeeff32a8ed1f0ab0ac275d644dd33df30b42567ad1f2cd41c7f725095d8b8673e71410966c62b4e1089ad2ab62422fe80ec2746f47ebdbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e67ffb6c439ed484826a3c67eb09d6a1

SHA1
6bc2412359bd3d08b054b06f7273a8b98dd73a8a

SHA256
df10c0a5be6f38717bc3be8e1825fa534a01441dca315b756e9eab0a5f712faa

SHA512
872bbed1702597055699dccf45a46bf84a93a065cae3fd835c7ed47bc6afe0af7d66da77ba77c3a7561c671d846a1a4183290d0d175db697d718f444d9c76e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
dc68525f296ad91542b9edc10a26d939

SHA1
ba5dbc57c7f98a3dc2553de8a7e540dfa77cc842

SHA256
a1e7f39f854b0026a0f4f5ebfed796e82f9c0d201a1009bef529df6c47665d47

SHA512
880e3e03df5bf93cecc8da9d6170a68409730ae8982ae1062e93dbdc7a844ef7fb333874ed3e684750060818422f21a6762b20d70c3f9b0abb709ed3aafb8ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
fc227c7b5bb13140fa376ade5beecc09

SHA1
a89ecd886011128b353ad825da02d5e5f797bd07

SHA256
acae4d01c69987496f97232108ba65ee139cbf61028e4e14b452a254436c3fc1

SHA512
860ee27a2e3d3532a72dd2574295fa34f7c52b9f18b921ff130feca85f0e247ddad28b089f99c92374e91d700c31896f03c707f41183612df8f28bb4ed1f1153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e21292a5effc4d81324574ce68ba3653

SHA1
09b2160cb7ae1eaa77a419ae0278320002595bbf

SHA256
a7cc5d7ca717c0d089a647ae017607d40b7baa1dfb6a10026983327aeabd6573

SHA512
21ca4884c56bae0af0bf3508c5a854e5f44f914b36e865a5e9daaa6aa4028fa70f9b000ae9501a6f571723c4b3e28b440c6e806be5aa6bc4a67db25f1e57f7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
0ae5bf11c8767f56138d219790e7d48c

SHA1
1d54f03375e3e9c9edac2dafd5083678c7ff1f0f

SHA256
10d1f3b20b1258db8f14b88795e86cb6e2e177b6e909d641c2000d76d4ff5381

SHA512
4f846508b34ed535ccebb539049907e264755ec16f9e2dcecbef9f1b89b59d4343b4849563475f4d84db3c1ac684f866dc204e9452bda5067a7113db1a58c966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2da0241c4618dd06a8ad73a69903595d

SHA1
52d181f18d069884ae945fda4f6d8f8830dd341c

SHA256
798547c3ee27c046d65ff0c76f4ab7805322c7dd2dbfdbd2b05128fef44d518f

SHA512
3ba1d249c3dd6021ae830ca282ff5f62ffe4e2257334ba1a28439e408c0276ca1ecf3ca7d166eeb397a8d39dc84cc5d2a2f7409a3a541ff9e82879eee6dbb41f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
1f25e75f918ee51322cba4c70f8b5c92

SHA1
9bf9e69452637a2b41f31317b642371804d26327

SHA256
4ffc8c60f4cfecd2a9e1cd7eedc62ac83a4999c24c497e01aa91f06782bd4bbf

SHA512
79d95d01dec77dec863ca625e21afb0fdd182171932a49c87dd4162ac39820a793f7aa7683907805b1d45eea95d6407d4417dfdc542773fe9acf894b8dcc5c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
802e55e997a23d2c6359e0ba03913f30

SHA1
9e9ce29ac26da226762a993217e00fb4b87bd4e4

SHA256
aa15f04f1a94a9921cae5b4b2d87f0639bdd2484247394f4b5132f30863ddf80

SHA512
1210f5fedcc44daa5760ac203daa61efb40b434decfd0727899802b44f4bc325dc6788c921703dc971ab6ac89bb96c9f65e26f77e4cd46c65b6b7c06d718dbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f02efbe6-cc9c-4cf0-a9a1-bbf1d0022840.tmp

Filesize
20KB

MD5
6bc6ba63389deba090173509f4fd208e

SHA1
034a2832fe0d756c6a6d7473cc387a27e75d052e

SHA256
7dde95392a05b9d92d9d161db4c3b252529d54268c18b643e390dade783c1025

SHA512
ea8046e5be087efae241af2d9bfc5357d4b0eb1c2b90e3c3b9434718ac328f149a12d721e21acba43732e183da3d6fba708670d8c2b68ab68cb0c03f5dbc7329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
333bc4f2879f28269c449e3147be643d

SHA1
f49f76f823c8c186e971adff688d285e4a82ac33

SHA256
9f8ed822caafe7156e42141356e6eea7bebd4e61f91083e75f9439e77ce18f03

SHA512
ca8f74467721ab65639a3a0da9573557e678610944eb2942c422a6d18506aec6e3176f264f5bff294f6bafe093c3cd79c31120903d5b5f42493c045ec1c21681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
f3c8b8bacfe0625b4db2e928261b0237

SHA1
a95b303f7d383b76e4878d320c19245737411cbc

SHA256
1ceae2b6382980fe8774a9bfa4b47b70e583a486cfbbe7bf3acfa3fbfed0e408

SHA512
267888237cb8fd072525d7adc03855d2f377a680357c64fc608ae7f7984cf4670fae7530205d646b9abb8b66deec5f9f72a1cccd7e124d9eca082afc3095d343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
d41962f8db7f13cb317bacf050453926

SHA1
157b9fc72a88db31ba90a6bb5ffc8e7e64a71b4e

SHA256
f2eeb5b85d94f54e28a82ff308a5345012958ff7920edf25f6498cef71d702fc

SHA512
8059b4e8a0dca76d65a8d9f0a5090d4b4dd3965c37b44f2029181645254fc575406783e719fa76a40cc97606507035cd0293fdc8cd1abd785b55a8753acd5092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
9f9d05e2fc865af51dc887a1490dc11a

SHA1
786fad692db6b29d85205c362dcc948c57134b37

SHA256
78f0465a486a36176a04751143eb27c9eb306f3bc4b393a3c47f33e52552588b

SHA512
28ef40d97e65d428e48d9934f3298f1350c55c647c6a3e5bec7e927a840375eb7cc8893372936d57085b74e9d11c0d161a4713e27c216e080db2cbd20340a6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.19.1\typosquatting_list.pb

Filesize
623KB

MD5
53c198434a158fa8db3323e0c764d99f

SHA1
df15e6e77f5385cb64e03eec8a21717749116e17

SHA256
cd566951c0822c5adc4948c22aa78b0e942094649b1d89d5bf0add6dd8311596

SHA512
8c49f6b663062decb6d64d3217a7317d8134314ecf48612b4e625a54108f532246056d8c20842a0d0c85f0ffb4c78aa3b9b5e7f79e31d7d1639b82b3469c4164

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nl0en2h2.3vj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1571631173\manifest.json

Filesize
118B

MD5
a4f6a8fe38bc86d5ecc06e0e30011160

SHA1
43aeb686f1762284aecb49e5fcf16f93dd64aa91

SHA256
c4d13a25e286281d81676b8cb8a7572d88b38710c9a69e21adecbc16fd185654

SHA512
9badac8cc91a55b579fda71441aee06958d2a6a3cbdf840ff60c2493a97c3298d8eac194b13208fc11f1f0a5fba24982af8d08def3478226ff1d14e953dfa834

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_1757084276\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3260_299533160\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/2192-37-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-12-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-39-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-36-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-35-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-34-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-33-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-32-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-0-0x00007FFCB8093000-0x00007FFCB8095000-memory.dmp

Filesize
8KB

Download
memory/2192-31-0x00007FFCB8093000-0x00007FFCB8095000-memory.dmp

Filesize
8KB

Download
memory/2192-15-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-14-0x000002444C460000-0x000002444CEA4000-memory.dmp

Filesize
10.3MB

Download
memory/2192-13-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-55-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-59-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-38-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-11-0x000002444B360000-0x000002444B412000-memory.dmp

Filesize
712KB

Download
memory/2192-10-0x0000024430850000-0x0000024430858000-memory.dmp

Filesize
32KB

Download
memory/2192-9-0x000002444B1F0000-0x000002444B358000-memory.dmp

Filesize
1.4MB

Download
memory/2192-8-0x000002444AB30000-0x000002444AB88000-memory.dmp

Filesize
352KB

Download
memory/2192-7-0x000002444AAA0000-0x000002444AB22000-memory.dmp

Filesize
520KB

Download
memory/2192-6-0x0000024430870000-0x000002443089C000-memory.dmp

Filesize
176KB

Download
memory/2192-5-0x000002444AFF0000-0x000002444B1E4000-memory.dmp

Filesize
2.0MB

Download
memory/2192-220-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/2192-3-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/2192-4-0x000002444AD00000-0x000002444AFE2000-memory.dmp

Filesize
2.9MB

Download
memory/2192-2-0x0000024430810000-0x0000024430811000-memory.dmp

Filesize
4KB

Download
memory/2192-1-0x000002442E470000-0x00000244303F2000-memory.dmp

Filesize
31.5MB

Download
memory/2192-248-0x000002444B570000-0x000002444B723000-memory.dmp

Filesize
1.7MB

Download
memory/3800-52-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-48-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-49-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-50-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-51-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-53-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-47-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-41-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-42-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/3800-43-0x000001F4D6500000-0x000001F4D6501000-memory.dmp

Filesize
4KB

Download
memory/5240-30-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/5240-27-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/5240-26-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download
memory/5240-25-0x000001DB2CAD0000-0x000001DB2CAF2000-memory.dmp

Filesize
136KB

Download
memory/5240-16-0x00007FFCB8090000-0x00007FFCB8B52000-memory.dmp

Filesize
10.8MB

Download